CVE-2026-53671: CWE-682: Incorrect Calculation in vbpf prevail

The prevail tool, a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer, prior to version 0.2.4, incorrectly models writes through a T_CTX-typed base register as silent no-ops. Specifically, the do_mem_store function only models T_STACK stores, and the checker does not test AccessType::write for T_CTX bounds. This flaw allows an attacker to craft an eBPF program that overwrites a context field (e.g., ctx->data), reloads it as T_PACKET, and dereferences an attacker-controlled address. Despite this, prevail reports the program as safe, leading to a critical verification bypass. The issue is fixed in version 0.2.4.

An attacker can bypass the eBPF verification process by exploiting prevail's incorrect handling of context field writes, potentially leading to unsafe memory dereferences. This undermines the security guarantees of eBPF programs verified by prevail, possibly enabling arbitrary memory access or code execution through attacker-controlled data. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector and no required privileges or user interaction.

A fix is available in prevail version 0.2.4. Users should upgrade to version 0.2.4 or later to address this vulnerability. No other mitigation is indicated by the vendor advisory.