CVE-2026-74720: Linux Kernel BPF Privilege Escalation

CVE-2026-74720 Overview

CVE-2026-74720 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) verifier. The flaw resides in adjust_ptr_min_max_vals(), which handles pointer arithmetic operations. When the kernel processes commuted arithmetic of the form scalar += pointer, the destination register inherits pointer state from the source pointer through selective field copying. This partial copy fails to preserve pointer provenance tracked across multiple bpf_reg_state fields, including frame numbers for PTR_TO_STACK registers and parent identity fields. A local attacker with the ability to load BPF programs can exploit this state inconsistency to bypass verifier safety checks.

Critical Impact
Local attackers with BPF program loading privileges can leverage inconsistent pointer state tracking to achieve memory corruption in kernel space, leading to privilege escalation.

Affected Products

Linux kernel (mainline and stable branches prior to the referenced fix commits)
Distributions shipping vulnerable kernel builds with BPF enabled
Systems permitting unprivileged BPF program loading or granting CAP_BPF/CAP_SYS_ADMIN

Discovery Timeline

2026-08-22 - CVE-2026-74720 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74720

Vulnerability Analysis

The BPF verifier statically analyzes eBPF programs before execution to guarantee memory safety within the kernel. The verifier tracks pointer state through the bpf_reg_state structure, which records provenance across multiple fields including type, offset ranges, frame number, and parent linkage. The function adjust_ptr_min_max_vals() computes the resulting register state after pointer arithmetic operations.

When the operand order is commuted such that a scalar receives a pointer addition (scalar += pointer), the destination register must adopt the source pointer's provenance. The vulnerable implementation copied only selected fields from the source pointer to the destination. This selective copy left inconsistent state across the register's provenance fields, producing a register that the verifier partially treats as a pointer and partially as a scalar. The Linux kernel is a local attack surface for this issue [CWE-119].

Root Cause

The root cause is fragile field-by-field state copying in pointer arithmetic commutation. Pointer provenance in the BPF verifier spans several fields, and copying a subset produces registers with inconsistent frame identifiers and parent linkage. For PTR_TO_STACK registers, an incorrect frame number allows the verifier to accept accesses that reference an unintended stack frame.

Attack Vector

Exploitation requires local access and the ability to load BPF programs. An attacker crafts an eBPF program that performs commuted pointer arithmetic to produce a register with inconsistent state. The verifier accepts the program because individual field checks pass, but at runtime the register operates on memory outside its intended bounds. The fix, applied across kernel patches 29c239f8, 8109c25e, 86b203aa, 8cb23101, a4c6f804, d1959028, db6382ed, and eaffa149, uses the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state.

No public proof-of-concept exploit is available at the time of publication. Refer to the upstream commits for technical details: Kernel Patch 29c239f8 and Kernel Patch eaffa149.

Detection Methods for CVE-2026-74720

Indicators of Compromise

Unexpected BPF program loads from non-administrative user contexts, especially by processes that do not typically use eBPF
Kernel oops or panic entries in dmesg referencing BPF verifier state or stack pointer arithmetic
Unexplained privilege escalations preceded by bpf() syscall activity

Detection Strategies

Audit bpf() syscall usage with auditd rules targeting BPF_PROG_LOAD operations and correlate against expected workloads
Monitor for kernel modules or user processes loading BPF programs with complex pointer arithmetic patterns
Track processes that acquire CAP_BPF or CAP_SYS_ADMIN capabilities outside baseline behavior

Monitoring Recommendations

Enable kernel lockdown and log BPF program load events to a centralized SIEM for correlation across hosts
Alert on newly loaded BPF programs from unprivileged UIDs when kernel.unprivileged_bpf_disabled is set to 0
Baseline eBPF telemetry from observability tools and flag deviations that may indicate exploitation attempts

How to Mitigate CVE-2026-74720

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry and reboot affected systems
Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs
Restrict CAP_BPF and CAP_SYS_ADMIN to administrative accounts and remove from container workloads that do not require them

Patch Information

The fix is distributed across multiple stable branch commits. Apply the patch matching your kernel branch: Kernel Patch 29c239f8, Kernel Patch 8109c25e, Kernel Patch 86b203aa, Kernel Patch 8cb23101, Kernel Patch a4c6f804, Kernel Patch d1959028, Kernel Patch db6382ed, and Kernel Patch eaffa149. Consume the fix through your distribution's security update channel when available.

Workarounds

Disable unprivileged BPF program loading system-wide by writing 1 to /proc/sys/kernel/unprivileged_bpf_disabled
Apply seccomp filters or Linux Security Modules to block the bpf() syscall for untrusted workloads
In container environments, drop the CAP_BPF and CAP_SYS_ADMIN capabilities from workload security contexts

bash

# Configuration example
# Disable unprivileged BPF at runtime
sysctl -w kernel.unprivileged_bpf_disabled=1

# Persist the setting across reboots
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-disable-unpriv-bpf.conf

# Verify the current state
sysctl kernel.unprivileged_bpf_disabled