Executive brief
The Linux kernel's eBPF (extended Berkeley Packet Filter) verifier contains a flaw in pointer arithmetic handling that could allow unprivileged attackers to corrupt kernel memory or bypass security restrictions. eBPF programs are used throughout the kernel for networking, tracing, and security enforcement. Exploitation could lead to privilege escalation, data theft, or system compromise.
Technical details
The vulnerability exists in the adjust_ptr_min_max_vals() function in kernel/bpf/verifier.c, which handles arithmetic operations involving pointers. When commuted scalar addition is performed (scalar += pointer), the code previously copied only selected fields (type and id) from the pointer register to the destination, leaving other pointer provenance fields inconsistent. This fragile partial-copy approach fails to preserve the complete register state, including frame numbers for stack pointers. An attacker can craft a malicious eBPF program that exploits this state inconsistency to forge pointer values or bypass verifier checks. The fix involves copying the complete pointer register state while preserving the scalar offset in a temporary register.
Affected products
- Linux Linux kernel affected versions across linux-2.6 through linux-7.2 stable branches
Timeline
- 2026-08-22: disclosed: CVE-2026-74720 published
- 2026-08-19: patched: Fix committed to stable kernel trees
- 2026-07-29: other: Original fix authored by Yiyang Chen