{"id":"CVE-2026-53670","title":"PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer","summary":"PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carri…","severity":"none","cwe":["CWE-682"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:49:20.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53670","references":[{"url":"https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/releases/tag/v0.2.4","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/security/advisories/GHSA-2qc8-qh94-66rc","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/security/advisories/GHSA-2qc8-qh94-66rc","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00291,"epssPercentile":0.21926,"ingestedAt":"2026-09-09T17:16:03.071Z","slug":"CVE-2026-53670","body":"## Overview\n\nPREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}