Executive brief
PREVAIL is a verification tool that checks the safety of eBPF programs (bytecode routines that run in the Linux kernel) before execution. The tool failed to properly validate certain arithmetic operations on pointer values, allowing unsafe programs to be marked as verified. An attacker who can submit eBPF programs—including unprivileged users on many systems—could exploit this to load programs that crash the kernel or cause unpredictable behavior.
Technical details
The vulnerability is a validation bypass in the PREVAIL eBPF verifier affecting ALU32 (32-bit arithmetic) ADD and SUB instructions on pointer-typed registers. The root cause is that the verifier does not check the is64 flag and fails to account for the fact that 32-bit arithmetic zero-extends results into 64-bit registers, corrupting pointer values by destroying their upper half. An unprivileged user who can load eBPF programs can craft a program that passes verification but faults or misbehaves at runtime, such as dereferencing a corrupted address. The fix, released in version 0.2.4, ensures the verifier "forgets" (discards) truncated ALU32 pointer arithmetic results, preventing their later use as pointers or leaked as scalar values.
Affected products
- vbpf PREVAIL prior to 0.2.4
Timeline
- 2026-09-02: disclosed
- 2026-06-01: patched: Version 0.2.4 released