« Volver al listado

CVE-2026-74720

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve pointer state for commuted arithmetic

When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields.

Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI:N indica escalada local; ejecución de código kernel via BPF JIT es posible; DoS y acceso a credenciales kernel como impactos secundarios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Developer GuidanceActive Directory ConfigurationUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-74720",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "86b203aadc2930e0a4f9c6277b5b80ff3664c472",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "8109c25e0c41f5f19a1c2380bb49c991a877494e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "d1959028190a7649b926f5867a58de5fe221b23c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "8cb23101a3fcc7432b451ea3d0f14a90711f4acf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "29c239f8dbec5ab33a61796724d189bddee6cd4b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "db6382ed3361bdd8129572a3423956cba1dae829",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "eaffa1495e4fe6330aeff9f323ea3d48b01f118a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f4d7e40a5b7157e1329c3c5b10f60d8289fc2941",
              "lessThan": "a4c6f804b44c5c790269b25e0e61cf4e9f117c86",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-22T16:16:46.957",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/29c239f8dbec5ab33a61796724d189bddee6cd4b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8109c25e0c41f5f19a1c2380bb49c991a877494e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/86b203aadc2930e0a4f9c6277b5b80ff3664c472",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8cb23101a3fcc7432b451ea3d0f14a90711f4acf",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a4c6f804b44c5c790269b25e0e61cf4e9f117c86",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d1959028190a7649b926f5867a58de5fe221b23c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/db6382ed3361bdd8129572a3423956cba1dae829",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eaffa1495e4fe6330aeff9f323ea3d48b01f118a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve pointer state for commuted arithmetic\n\nWhen scalar += pointer is handled in adjust_ptr_min_max_vals(), the\ndestination register inherits the pointer state from the source pointer.\nCopying only selected fields is fragile because pointer provenance is\ntracked by several bpf_reg_state fields.\n\nUse the caller's temporary offset register to preserve the scalar operand\nwhile replacing the destination with the full pointer state. This preserves\nthe frame number for PTR_TO_STACK registers and keeps parent identity\nfields consistent."
    }
  ],
  "lastModified": "2026-08-25T06:18:57.637",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}