---
id: CVE-2026-53670
title: >-
  PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation
  Layer
summary: >-
  PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation
  Layer. Prior to version 0.2.4, in the Prevail eBPF verifier,
  EbpfTransformer::add() silently skips offset-variable updates when the
  destination register carri…
severity: none
cwe:
  - CWE-682
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:49:20.627'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53670'
references:
  - url: >-
      https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/releases/tag/v0.2.4'
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/security/advisories/GHSA-2qc8-qh94-66rc'
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/security/advisories/GHSA-2qc8-qh94-66rc'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00507
epssPercentile: 0.4062
ingestedAt: '2026-09-09T17:16:03.071Z'
---

## Overview

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.