CVE-2026-53706

The prevail eBPF verifier, prior to version 0.2.4, accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag (CWE-682, incorrect calculation). Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer processed this way is silently destroyed at runtime, yet the verifier still marks the program as verified safe. Any caller able to submit an eBPF program for verification, including unprivileged users on kernels that permit BPF program loading, can submit a crafted program using ALU32 add/sub on pointer registers to trigger the bug. An attacker gains a program that passes verification but faults or misbehaves when it runs, matching the CVSS 4.0 profile of high integrity and availability impact with no confidentiality impact (8.8 High). Anyone running the prevail verifier before 0.2.4 to validate eBPF programs is affected; there is no known exploitation, no public proof-of-concept, no CISA KEV listing, and EPSS currently estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade the prevail verifier to version 0.2.4 or later, which checks the is64 flag for ALU32 ADD/SUB on pointer registers. Until patched, restrict who can submit eBPF programs for verification (for example, disable unprivileged BPF program loading where possible), and re-audit or re-verify any programs previously accepted by versions below 0.2.4 that use ALU32 ADD/SUB on pointer-typed registers, since those may corrupt pointers at runtime.