CVE-2026-53671

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-53671

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53671.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-53671

Aliases

GHSA-65rv-h458-cq99

Published

2026-09-02T17:54:30Z

Modified

2026-09-11T08:19:25Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

Details

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T_CTX-typed base register as a silent no-op: do_mem_store in src/crab/ebpf_transformer.cpp only models T_STACK stores, and the checker's T_CTX bounds arm never tests AccessType::write. An attacker can craft an eBPF program that overwrites a context field (e.g., ctx->data), reload that field typed as T_PACKET, and dereference an attacker-controlled address — and prevail will report the program as safe. This issue has been patched in version 0.2.4.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-682"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53671.json"
}

References

Affected packages

Git / github.com/vbpf/prevail

Affected ranges

Type

GIT

Repo

https://github.com/vbpf/prevail

Events

Introduced

Fixed

de65234f67d2608b54d12571edb585ead224363c

Fixed

67b6d03ebaa3341e2eee2aa74502003fd11e31de

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.2.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1-alpha

v0.1.2

v0.1.3

v0.2.0

v0.2.1

v0.2.2

v0.2.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-53671.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "325819816963706948020286327084670084607",
                "292296932851792067431938046770861753131",
                "34383716616628777476141986852030618733",
                "219181899613499748148685826037592350317"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53671-18800147",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "target":  {
            "file":  "src/test/test_yaml.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "48855170570012617046883621305847322205",
                "222789438237916717142731558889729258487",
                "19324497365723192909888656163048007136",
                "284501313559105805320077559296644594271",
                "111830726370636151816567131755360673647",
                "113850177699701960435762681227227285179",
                "22070787748745258950899715446642620489",
                "232505816026435567964617257353580005496"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53671-209d180a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "target":  {
            "file":  "src/ir/assertions.cpp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "286970546881615736298319486169085924293",
            "length":  4014
        },
        "id":  "CVE-2026-53671-85064b87",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "target":  {
            "file":  "src/crab/ebpf_checker.cpp",
            "function":  "operator()"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "179609023566655173945522412746902533120",
                "175173322696650712410359315577100999835",
                "255549378089553301570202208213787957997",
                "325756365711802535073401965742084634216",
                "2013879288682369649028678626344162121"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-53671-fe2e7c54",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/vbpf/prevail/commit/de65234f67d2608b54d12571edb585ead224363c",
        "target":  {
            "file":  "src/crab/ebpf_checker.cpp"
        }
    }
]

vanir_signatures_modified

"2026-09-11T08:19:25Z"