CVE-2026-53670
CriticalCVSS 9.3Summary
In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.
Risk Assessment
This could allow loading a malicious eBPF program, threatening kernel and system security.
Recommendation
Update PREVAIL to version 0.2.4 or later, which contains the fix.
Other vulnerabilities in PREVAIL
See all- CVE-2026-53706High
In PREVAIL versions prior to 0.2.4, the eBPF verifier accepts ALU32 ADD and SUB instructions on pointer-typed registers without checking the is64 flag. ALU32 arithmetic zero-extends the result, destroying the upper half of the pointer at runtime, yet the program is marked safe. Any caller can submit a program that passes verification but faults at runtime. Patched in version 0.2.4.
- CVE-2026-53671Critical
In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.
Original NVD description (English source)
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.