Database/Kernel, userspace & hypervisor
PREVAIL: ALU32 arithmetic on pointers passes verification but truncates the pointer at runtime
Impact
Before 0.2.4, PREVAIL accepts ALU32 ADD and SUB instructions operating on pointer-typed registers without checking the is64 flag. ALU32 arithmetic zero-extends its 32-bit result, so the top half of the pointer is destroyed when the program actually runs, while the verifier still marks it safe. A submitter can therefore get a program past verification that faults or otherwise misbehaves once loaded. The record states the practical impact as integrity and availability of the host running the program rather than direct data disclosure. This is a separate defect from CVE-2026-53671 with its own commit; both land in the same release.
Who can reach it
Any caller able to submit an eBPF program for verification, including unprivileged users on kernels or hosts that permit BPF program loading through a PREVAIL-gated path. No authentication is described.
What to do
Upgrade PREVAIL to 0.2.4 (commit d3fab8c) and rebuild and restart the components that embed it. No standalone mitigation is described in the advisory beyond not accepting programs from untrusted submitters.
References
Related entries
- Linux kernel (arch/x86/kvm/mmu): A guest that creates a hugepage mapping extending below the bounds of a memslot makesCVE-2026-63807 · Linux kernel (arch/x86/kvm/mmu)High
- Linux kernel (net/xfrm): Transport-mode reinjection stashes a network-namespace pointer in the socket buffer's controlCVE-2026-63919 · Linux kernel (net/xfrm)High
- Linux kernel (arch/x86/kvm/svm): KVM read Page State Change entries and indices out of a guest-writable buffer moreCVE-2026-63937 · Linux kernel (arch/x86/kvm/svm)High
- Linux kernel (drivers/vfio/pci): Vfio-pci exports a dma-buf over BAR memory without confirming those BAR resources wereCVE-2026-64042 · Linux kernel (drivers/vfio/pci)High
- Linux kernel crypto/ecc: missing carry in 128-bit accumulation corrupts ECC arithmetic at a boundaryCVE-2026-64313 · Linux kernel crypto/ecc (vli multiplication carry handling)High
- Linux kernel QAT: use-after-free tearing down SR-IOV while VF2PF response work is in flightCVE-2026-64438 · Linux kernel Intel QAT driver (VF2PF work teardown in adf_disable_sriov)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.