CVE-2026-53671
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.29%
- CWE
- CWE-682
- Published
- 2026-09-02
- Last modified
- 2026-09-05
Affected products
- vbpf prevail
Weakness type
Related vulnerabilities
- CVE-2026-86736 — snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
- CVE-2026-53706 — PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs
- CVE-2026-53670 — PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
- CVE-2026-20275 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
- CVE-2026-76043 — Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to...
- CVE-2026-71479 — New API: Integer overflow in quota billing yields negative charges (self-crediting)
- CVE-2026-20763 — Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User...