CVE-2026-53671

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53671

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53671.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53671

Aliases

GHSA-65rv-h458-cq99

Published

2026-09-02T17:54:30.682Z

Modified

2026-09-04T08:05:25.998866Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

Details

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the checker's TCTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53671.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-682"
    ]
}

References

Affected packages

Git / github.com/vbpf/prevail

Affected ranges

Type

GIT

Repo

https://github.com/vbpf/prevail

Events

Introduced

Fixed

de65234f67d2608b54d12571edb585ead224363c

Fixed

67b6d03ebaa3341e2eee2aa74502003fd11e31de

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.2.4"
        }
    ]
}

Affected versions

v0.*

v0.1-alpha

v0.1.2

v0.1.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "325819816963706948020286327084670084607",
                "292296932851792067431938046770861753131",
                "34383716616628777476141986852030618733",
                "219181899613499748148685826037592350317"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53671-18800147",
        "target": {
            "file": "src/test/test_yaml.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "48855170570012617046883621305847322205",
                "222789438237916717142731558889729258487",
                "19324497365723192909888656163048007136",
                "284501313559105805320077559296644594271",
                "111830726370636151816567131755360673647",
                "113850177699701960435762681227227285179",
                "22070787748745258950899715446642620489",
                "232505816026435567964617257353580005496"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53671-209d180a",
        "target": {
            "file": "src/ir/assertions.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 4014.0,
            "function_hash": "286970546881615736298319486169085924293"
        },
        "id": "CVE-2026-53671-85064b87",
        "target": {
            "function": "operator()",
            "file": "src/crab/ebpf_checker.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "179609023566655173945522412746902533120",
                "175173322696650712410359315577100999835",
                "255549378089553301570202208213787957997",
                "325756365711802535073401965742084634216",
                "2013879288682369649028678626344162121"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-53671-fe2e7c54",
        "target": {
            "file": "src/crab/ebpf_checker.cpp"
        },
        "source": "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53671.json"

vanir_signatures_modified

"2026-09-04T08:05:25Z"