---
id: CVE-2026-53671
title: >-
  PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation
  Layer
summary: >-
  PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation
  Layer. Prior to version 0.2.4, the abstract transformer in prevail treats
  writes through a T_CTX-typed base register as a silent no-op: do_mem_store in
  src/cr…
severity: none
cwe:
  - CWE-682
published: '2026-09-02'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T16:49:20.627'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53671'
references:
  - url: >-
      https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/releases/tag/v0.2.4'
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/security/advisories/GHSA-65rv-h458-cq99'
    label: security-advisories@github.com
  - url: 'https://github.com/vbpf/prevail/security/advisories/GHSA-65rv-h458-cq99'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00291
epssPercentile: 0.21974
ingestedAt: '2026-09-05T20:44:35.254Z'
---

## Overview

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.