CVE-2026-53671
CriticalCVSS 9.3Summary
In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.
Risk Assessment
Unsafe eBPF programs may be loaded into the kernel, potentially leading to memory corruption and privilege escalation.
Recommendation
Update PREVAIL to version 0.2.4 or later, which contains the fix.
Other vulnerabilities in PREVAIL
See all- CVE-2026-53706High
In PREVAIL versions prior to 0.2.4, the eBPF verifier accepts ALU32 ADD and SUB instructions on pointer-typed registers without checking the is64 flag. ALU32 arithmetic zero-extends the result, destroying the upper half of the pointer at runtime, yet the program is marked safe. Any caller can submit a program that passes verification but faults at runtime. Patched in version 0.2.4.
- CVE-2026-53670Critical
In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.
Original NVD description (English source)
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.