CVE-2026-53670

The record

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, in the Prevail eBPF verifier, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset (two or more simultaneously possible pointer types). Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime. This issue has been patched in version 0.2.4.

Affected packages

Related vulnerabilities

• CVE-2026-53671 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-53706 PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. CWE-682
• CVE-2026-54754 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-682
• CVE-2026-76043 Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote… CWE-682
• CVE-2026-20763 Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within… CWE-682
• CVE-2026-55597 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-682
• CVE-2026-10512 The X25519 x86_64 assembly implementation fails to clear the most significant bit during… CWE-682
• CVE-2026-44074 Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting… CWE-682