CVE-2026-53671: PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the checker's TCTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as TPACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PREVAILto a version that resolves this vulnerability.Fixed in 0.2.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using PREVAIL versions prior to 0.2.4 to verify eBPF programs are exposed. The issue affects verification of programs that perform writes through a context-typed base register.
What does an attacker need to exploit this issue?
An attacker needs the ability to submit or otherwise have PREVAIL verify a crafted eBPF program. The program can overwrite a context field, reload it as a packet-typed value, and dereference an attacker-controlled address while still being reported safe.
How can I determine whether my verifier is affected?
Check the PREVAIL version in use. Versions before 0.2.4 are affected; version 0.2.4 includes the patch.
What should be done if patching cannot happen immediately?
Do not rely on affected PREVAIL versions to safely validate untrusted eBPF programs. Restrict submission of eBPF programs that PREVAIL will verify until version 0.2.4 can be deployed.