CVE-2026-53670
Received Received - Intake

Prevail eBPF Verifier Memory Corruption via Stale Offset

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: GitHub, Inc.

Description
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-53670
EUVD
EUVD-2026-70244

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vbpf prevail to 0.2.4 (exc)
vbpf prevail 0.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the PREVAIL eBPF verifier before version 0.2.4. When arithmetic operations are performed on registers with multiple possible pointer types, the offset update is skipped, leaving stale offset values. This causes bounds checks to use incorrect offsets, allowing out-of-bounds memory access during verification. The issue was fixed by invalidating offset variables in such cases.

Detection Guidance

This vulnerability is specific to the PREVAIL eBPF verifier and requires checking the version of the software in use. If you are running PREVAIL versions 0.2.3 or earlier, the system is vulnerable. No direct network or system commands can detect this flaw without inspecting the PREVAIL verifier version.

Impact Analysis

An attacker could exploit this to submit malicious BPF programs that pass verification but perform out-of-bounds memory reads or writes at runtime. This may lead to kernel memory corruption, privilege escalation, or information disclosure, depending on the system configuration and attacker capabilities.

Compliance Impact

This vulnerability allows out-of-bounds memory access in eBPF programs, which could lead to kernel memory corruption, privilege escalation, or information disclosure. Such risks directly impact compliance with standards like GDPR (data protection) and HIPAA (health data security) by increasing the likelihood of unauthorized data access or system compromise.

Mitigation Strategies

Upgrade the PREVAIL eBPF verifier to version 0.2.4 or later, which includes the patch for this vulnerability. This addresses the root cause by ensuring offset variables are properly invalidated during arithmetic operations on non-singleton typesets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart