CVE-2026-53706: CWE-682: Incorrect Calculation in vbpf prevail

PREVAIL is a Polynomial-Runtime eBPF verifier using abstract interpretation. Versions before 0.2.4 accept ALU32 ADD and SUB instructions on pointer-typed registers without verifying the is64 flag. Since ALU32 arithmetic zero-extends 32-bit results, the upper half of pointers is destroyed at runtime, but PREVAIL incorrectly marks such programs as safe. This enables unprivileged users on kernels permitting BPF loading to submit programs that pass verification but cause faults or misbehavior at runtime. The vulnerability is tracked as CVE-2026-53706 with a CVSS 4.0 score of 8.8 (high severity). It has been patched in version 0.2.4.

An attacker able to submit eBPF programs can create programs that bypass the verifier's safety checks, leading to runtime faults or misbehavior due to incorrect pointer calculations. This can cause instability or potential denial of service in environments using the PREVAIL verifier prior to version 0.2.4. No known exploits in the wild have been reported.

Upgrade to PREVAIL version 0.2.4 or later, where this issue has been patched. No other mitigation or workaround is documented. Until upgraded, restrict unprivileged users from loading eBPF programs if possible.