CVE-2026-74720

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. When a scalar value is added to a pointer during certain arithmetic operations, the system fails to fully preserve the pointer's state. This inconsistency in how the pointer's origin and properties are tracked can lead to memory corruption or information disclosure. An attacker could potentially leverage this to impact system stability or gain unauthorized access to sensitive data.

BPF verifier pointer provenance can be corrupted during commuted scalar and pointer arithmetic because scalar plus pointer used to copy only selected fields from the source pointer register into the destination register. For PTR_TO_STACK and other pointer types, provenance is carried by multiple bpf_reg_state fields such as frame number and parent identity, so partial copying can leave the verifier with an inconsistent pointer state. For the CVSS the PR:L value is used because a local user or process needs the ability to load a BPF program, while full root privileges are not assumed when BPF loading is delegated or unprivileged BPF is enabled. The issue is not network reachable and requires local BPF program submission. Impact is at least local denial of service, and in the paranoid view it may allow confidentiality and integrity impact or privilege escalation due to verifier unsoundness and possible unsafe pointer access.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.