PREVAIL eBPF verifier: stale offset tracking lets out-of-bounds BPF programs pass verification

Impact

PREVAIL's abstract interpreter silently skips offset-variable updates when the destination register holds a non-singleton typeset, so later bounds checks run against a stale offset and accept memory accesses that are out of bounds at runtime. Anything that relies on PREVAIL as its safety gate before loading BPF bytecode - the verifier is used outside the Linux in-kernel verifier, notably in eBPF-for-Windows and in tooling that pre-screens programs - can be handed a crafted program that passes review and then corrupts memory in the execution context. Where a fleet uses PREVAIL to admit tenant- or third-party-supplied BPF for observability or networking, the admission decision cannot be trusted. This does not affect the in-kernel Linux verifier, which is separate code.

Who can reach it

Anyone who can submit a BPF program to a component that uses PREVAIL for verification. Reach depends entirely on the deployment - it is only exposed where untrusted bytecode is accepted.

What to do

Update PREVAIL to 0.2.4 and rebuild or update whatever embeds it, then restart the affected component. There is no configuration mitigation for the verifier logic itself; until the dependency is updated, stop accepting BPF programs from untrusted sources on that path.

References

Related entries

• PREVAIL: writes through a context pointer are modelled as a no-op, so unsafe eBPF programs verify as safeCVE-2026-53671 · PREVAIL eBPF verifier (T_CTX store abstract transformer)Critical
• Linux kernel (arch/x86/kvm/svm): Page State Change requests from a confidential guest were validated against theCVE-2026-63938 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel (arch/x86/kvm/svm): KVM computed the usable size of the guest-provided GHCB scratch area wrongly, so aCVE-2026-63939 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel (arch/x86/kvm/svm): A confidential guest can hand KVM a port-I/O request with length or count zeroCVE-2026-63940 · Linux kernel (arch/x86/kvm/svm)Critical
• Linux kernel arm_ffa: use-after-free racing a notifier unregister against notification deliveryCVE-2026-64080 · Linux kernel arm_ffa firmware driver (notification callback lookup)Critical
• Linux kernel (drivers/iommu/intel): The VT-d scalable-mode context entry is zeroed while its Present bit is still setCVE-2026-74439 · Linux kernel (drivers/iommu/intel)Critical