Look up another CVE · open CVE-2026-74720 in the interactive tracker
CVE-2026-74720
bpf: Preserve pointer state for commuted arithmetic
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem kernel/bpf. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74720 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/bpf/verifier.c
- What this is
- BPF [CORE]MAINTAINERS section matched on kernel/bpf/verifier.c · bpf@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_BPF|CONFIG_BPF_SYSCALL' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_BPF, CONFIG_BPF_SYSCALL
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.3% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel/bpf
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.16 | 5.10.265 | 86b203aadc29 |
| 4.16 | 5.15.216 | 8109c25e0c41 |
| 4.16 | 6.1.183 | d1959028190a |
| 4.16 | 6.6.152 | 8cb23101a3fc |
| 4.16 | 6.12.104 | 29c239f8dbec |
| 4.16 | 6.18.45 | db6382ed3361 |
| 4.16 | 7.1.9 | eaffa1495e4f |
| 4.16 | 7.2 | a4c6f804b44c |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is in bpf_check()/adjust_ptr_min_max_vals() during bpf(BPF_PROG_LOAD) via the local bpf(2) syscall; per kernel CNA guidance BPF verifier bugs are Local, not reachable from remote network packet handling.
- AC:LAttack complexity, low
- An attacker fully controls BPF bytecode using commuted 64-bit scalar+=pointer ALU and bpf2bpf call chains, deterministically poisoning register state during verification without races or external preconditions.
- PR:LPrivileges required, low
- Exploitation requires loading bpf2bpf programs (CAP_BPF-gated), which is routinely available to unprivileged users via user namespaces/BPF token delegation or unprivileged socket-filter loading when kernel.unprivileged_bpf_disabled=0, not init-namespace root.
- UI:NUser interaction, none
- The attacker loads and executes their own crafted BPF program through bpf(2); no separate victim action such as mounting filesystems or opening files is required beyond the attacker's own local access.
- S:UScope, unchanged
- Impact is a BPF verifier bypass enabling in-kernel out-of-bounds memory access and privilege escalation within the host kernel's security authority; it does not cross VM, IOMMU, or sandbox boundaries.
- C:HConfidentiality impact, high
- Copying only type/id on scalar+=pointer leaves stale frameno, var_off, and map/parent metadata, so bpf_func() stack checks validate the wrong frame and approve out-of-bounds reads of adjacent kernel memory.
- I:HIntegrity impact, high
- The same incorrect pointer provenance permits verifier-approved out-of-bounds BPF stack/map writes at runtime, a controllable kernel memory corruption primitive leverageable for arbitrary modification and privilege escalation.
- A:HAvailability impact, high
- Out-of-bounds BPF memory accesses from the bypassed verifier state can corrupt critical kernel data or dereference invalid addresses, reliably causing kernel oops/panic and repeatable denial of service.