CVE-2026-53670

Prevail, an open-source eBPF verifier that uses abstract interpretation to prove BPF programs are memory-safe, contains an incorrect-calculation flaw (CWE-682) in its EbpfTransformer::add() routine in all versions prior to 0.2.4. When a register may hold one of two or more possible pointer types (a non-singleton typeset), the flaw silently skips updating that pointer's offset variable, so subsequent bounds checks run against a stale offset value. A crafted BPF program that performs an out-of-bounds memory access is therefore wrongly accepted as safe and can corrupt memory at runtime, defeating the memory-safety guarantee the verifier is meant to enforce. Anyone using Prevail before 0.2.4 — typically eBPF platforms and tools that embed the verifier to check programs before loading them — is affected, and the CVSS 4.0 score of 9.3 reflects that a remotely submitted, unprivileged BPF program can cause high-impact integrity and availability failures. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS currently estimates the 30-day exploitation probability at about 0.3%.

What to do: Upgrade Prevail to version 0.2.4 or later, and rebuild any downstream projects or tools that bundle or vendor the verifier against the patched release. If upgrading is not immediate, restrict or manually review loading of BPF programs that perform pointer arithmetic on registers with ambiguous (multi-type) pointer states, since those are the programs that can bypass the buggy bounds checks. Treat verifier acceptance as the security gate in your deployment, so prioritize patching wherever untrusted users can submit BPF programs.