# CVE-2026-53670: Prevail eBPF verifier memory-safety bypass in pointer arithmetic

Source: https://junglewise.ai/threats/cve-2026-53670-prevail-ebpf-verifier-memory-safety-bypass-in-pointer-arithmetic  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-53670 · Severity: info · CVSS 6.2 · Published 2026-09-02

Prevail is an eBPF program verifier that validates kernel-mode bytecode before execution. A verifier flaw allows specially crafted eBPF programs to bypass memory-access bounds checks and potentially corrupt kernel memory, even though the verifier incorrectly approves them as safe. This could enable privilege escalation or denial-of-service attacks on systems relying on Prevail for eBPF safety validation.

Technologies: [vBPF Prevail](https://junglewise.ai/threats/technologies/prevail). Vendors: [vBPF](https://junglewise.ai/threats/vendors/vbpf).

## Quick answers

**Is CVE-2026-53670 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53670 being exploited in the wild.

**How severe is CVE-2026-53670?** Informational severity, with a CVSS score of 6.2, published 2 September 2026.

**Which products and versions are affected?** vBPF Prevail prior to 0.2.4.

**Is there a fix for CVE-2026-53670?** A patch was published on 2026-06-01: Version 0.2.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53670 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-53670?** Check whether you run vBPF Prevail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a logic error in the EbpfTransformer::add() function of the Prevail verifier. When a destination register holds a non-singleton typeset (multiple possible pointer types simultaneously), the function silently fails to update the offset-variable state. Subsequent bounds-checking logic then consumes the stale offset value, allowing out-of-bounds memory accesses to pass verification. An attacker crafts an eBPF program that exploits this condition to construct out-of-bounds pointers that would cause memory corruption at runtime. The fix, released in version 0.2.4, applies "havoc" semantics (invalidates offsets) when pointer arithmetic occurs on non-singleton typesets, ensuring safe verification.

## Affected products

- vBPF Prevail prior to 0.2.4

## Timeline

- 2026-09-02: disclosed
- 2026-06-01: patched: Version 0.2.4 released

## References

- [https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61](https://github.com/vbpf/prevail/commit/2b209bc4e3d612ff9aca87125e67c0ff84477e61)
- [https://github.com/vbpf/prevail/releases/tag/v0.2.4](https://github.com/vbpf/prevail/releases/tag/v0.2.4)

## Related threats

- [PREVAIL eBPF verifier ALU32 pointer arithmetic verification bypass](https://junglewise.ai/threats/cve-2026-53706-prevail-ebpf-verifier-alu32-pointer-arithmetic-verification)
- [PREVAIL eBPF verifier context field write bypass](https://junglewise.ai/threats/cve-2026-53671-prevail-ebpf-verifier-context-field-write-bypass)