Polynomial-Runtime eBPF Verifier Vulnerability in Prevail by VBPF

CVE-2026-53670

What is CVE-2026-53670?

The Prevail eBPF Verifier, utilized for polynomial runtime verification, contains a vulnerability that allows crafted BPF programs to bypass verification checks. This occurs because the EbpfTransformer::add() function neglects to update offset variables when the destination register holds non-singleton typesets. As a result, bounds checks may fail, permitting unsafe out-of-bounds memory access, which could lead to program memory corruption at runtime. This issue has been addressed in the subsequent release version 0.2.4.

References