{"id":"CVE-2026-53671","summary":"PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification","details":"PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx-\u003edata), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.","aliases":["GHSA-65rv-h458-cq99"],"modified":"2026-09-04T08:05:25.998866Z","published":"2026-09-02T17:54:30.682Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-682"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53671.json"},"references":[{"type":"WEB","url":"https://github.com/vbpf/prevail/releases/tag/v0.2.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53671.json"},{"type":"ADVISORY","url":"https://github.com/vbpf/prevail/security/advisories/GHSA-65rv-h458-cq99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53671"},{"type":"FIX","url":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vbpf/prevail","events":[{"introduced":"0"},{"fixed":"de65234f67d2608b54d12571edb585ead224363c"},{"fixed":"67b6d03ebaa3341e2eee2aa74502003fd11e31de"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.2.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.3","v0.1.2","v0.1-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53671.json","vanir_signatures_modified":"2026-09-04T08:05:25Z","vanir_signatures":[{"target":{"file":"src/test/test_yaml.cpp"},"deprecated":false,"digest":{"line_hashes":["325819816963706948020286327084670084607","292296932851792067431938046770861753131","34383716616628777476141986852030618733","219181899613499748148685826037592350317"],"threshold":0.9},"id":"CVE-2026-53671-18800147","signature_type":"Line","signature_version":"v1","source":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c"},{"deprecated":false,"digest":{"line_hashes":["48855170570012617046883621305847322205","222789438237916717142731558889729258487","19324497365723192909888656163048007136","284501313559105805320077559296644594271","111830726370636151816567131755360673647","113850177699701960435762681227227285179","22070787748745258950899715446642620489","232505816026435567964617257353580005496"],"threshold":0.9},"id":"CVE-2026-53671-209d180a","signature_type":"Line","signature_version":"v1","source":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c","target":{"file":"src/ir/assertions.cpp"}},{"deprecated":false,"digest":{"function_hash":"286970546881615736298319486169085924293","length":4014},"id":"CVE-2026-53671-85064b87","signature_type":"Function","signature_version":"v1","source":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c","target":{"function":"operator()","file":"src/crab/ebpf_checker.cpp"}},{"deprecated":false,"digest":{"line_hashes":["179609023566655173945522412746902533120","175173322696650712410359315577100999835","255549378089553301570202208213787957997","325756365711802535073401965742084634216","2013879288682369649028678626344162121"],"threshold":0.9},"id":"CVE-2026-53671-fe2e7c54","signature_type":"Line","signature_version":"v1","source":"https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c","target":{"file":"src/crab/ebpf_checker.cpp"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}