CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the
destination register inherits the pointer state from the source pointer.
Copying only selected fields is fragile because pointer provenance is
tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand
while replacing the destination with the full pointer state. This preserves
the frame number for PTR_TO_STACK registers and keeps parent identity
fields consistent.

The Linux kernel CVE team has assigned CVE-2026-74720 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 5.10.265 with commit 86b203aadc2930e0a4f9c6277b5b80ff3664c472
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 5.15.216 with commit 8109c25e0c41f5f19a1c2380bb49c991a877494e
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.1.183 with commit d1959028190a7649b926f5867a58de5fe221b23c
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.6.152 with commit 8cb23101a3fcc7432b451ea3d0f14a90711f4acf
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.12.104 with commit 29c239f8dbec5ab33a61796724d189bddee6cd4b
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 6.18.45 with commit db6382ed3361bdd8129572a3423956cba1dae829
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 7.1.9 with commit eaffa1495e4fe6330aeff9f323ea3d48b01f118a
	Issue introduced in 4.16 with commit f4d7e40a5b7157e1329c3c5b10f60d8289fc2941 and fixed in 7.2 with commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74720
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/verifier.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472
	https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e
	https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c
	https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf
	https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b
	https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829
	https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a
	https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86