CVE-2026-53670: PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Prevail eBPF verifierto a version that resolves this vulnerability.Fixed in 0.2.4
Event History
Frequently Asked Questions
Which deployments are exposed?
PREVAIL versions prior to 0.2.4 are affected. Deployments using version 0.2.4 are patched.
What must an attacker provide to exploit the issue?
An attacker needs to supply a crafted eBPF program that causes the destination register in EbpfTransformer::add() to carry a non-singleton typeset with two or more possible pointer types. The stale offset can then cause verifier bounds checks to accept an out-of-bounds memory access.
How can I determine whether my verifier may have accepted a dangerous program?
Review eBPF programs accepted by affected PREVAIL versions for add() operations involving destination registers with multiple simultaneously possible pointer types, followed by bounds-checked memory accesses. The provided data does not identify a runtime detection indicator.