CVE-2026-53671

PREVAIL, the open-source polynomial-runtime eBPF verifier built on abstract interpretation, contains a soundness flaw (CWE-682, incorrect modeling) in versions prior to 0.2.4: its abstract transformer silently ignores stores made through a T_CTX-typed base register, because do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK writes and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field such as ctx->data, reloads that field now typed as T_PACKET, and dereferences an attacker-controlled address — a memory-unsafe operation that PREVAIL nonetheless reports as safe. Where PREVAIL's verdict is used to accept eBPF programs, such as in automated verification or acceptance gates, this lets attacker-supplied programs perform unchecked pointer dereferences, yielding high-impact unauthorized memory reads and writes; CVSS 4.0 scores the issue 9.3 (critical) with high confidentiality and integrity impact. Anyone running PREVAIL before 0.2.4 to verify eBPF programs is affected; the flaw is in the PREVAIL tool itself, not the Linux kernel's built-in verifier, and real-world impact depends on whether PREVAIL's safety verdict is trusted without independent checks. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates about a 0.3% probability of exploitation within 30 days.

What to do: Upgrade PREVAIL to version 0.2.4, which restores modeling of writes through T_CTX-typed base registers. Until then, do not accept untrusted eBPF programs on PREVAIL's verdict alone — keep kernel-side or independent runtime bounds checks in place. Re-review programs previously accepted by PREVAIL that write to context fields and then reload and dereference packet pointers, since those may contain unchecked memory accesses.