{"id":"CVE-2026-53671","title":"PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer","summary":"PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/cr…","severity":"none","cwe":["CWE-682"],"published":"2026-09-02","updated":"2026-09-09","sourceUpdated":"2026-09-09T16:49:20.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53671","references":[{"url":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/releases/tag/v0.2.4","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/security/advisories/GHSA-65rv-h458-cq99","label":"security-advisories@github.com"},{"url":"https://github.com/vbpf/prevail/security/advisories/GHSA-65rv-h458-cq99","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00291,"epssPercentile":0.21927,"ingestedAt":"2026-09-05T20:44:35.254Z","slug":"CVE-2026-53671","body":"## Overview\n\nPREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}