CVE-2026-53706
CVE-2026-53706 is a high-severity vulnerability with a CVSS 4.0 base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-682.
Key facts
- Severity: High (CVSS 4.0 base score 8.8)
- EPSS exploit prediction: 1% (41st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-682
- Published:
- Last modified:
Description
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer is silently destroyed at runtime, yet prevail marks the program as verified safe. Any caller that can submit an eBPF program for verification — including unprivileged users on kernels that permit BPF program loading — can produce a program that passes verification but faults or misbehaves at runtime. This issue has been patched in version 0.2.4.
Frequently asked questions
- What is CVE-2026-53706?
- PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the prevail eBPF verifier accepts ALU32 ADD and SUB instructions that operate on pointer-typed registers without checking the is64 flag. Because ALU32 arithmetic zero-extends the 32-bit result, the upper half of any pointer is silently destroyed at runtime, yet prevail marks the program as verified safe. Any caller that can submit an eBPF program for verification — including unprivileged users on kernels that permit BPF program loading — can produce a program that passes verification but faults or misbehaves at runtime. This issue has been patched in version 0.2.4.
- How severe is CVE-2026-53706?
- CVE-2026-53706 has a CVSS 4.0 base score of 8.8, rated high severity.
- Is CVE-2026-53706 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-53706?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-53706 published?
- CVE-2026-53706 was published on 2026-09-02 and last updated on 2026-09-09.
References
- https://github.com/vbpf/prevail/commit/d3fab8c23a93d9a615bc741b254ab26391559e0f
- https://github.com/vbpf/prevail/releases/tag/v0.2.4
- https://github.com/vbpf/prevail/security/advisories/GHSA-65fp-5qmq-gg2m
Other CWE-682 vulnerabilities
- CVE-2023-2163 — Critical (CVSS 10.0): Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe,…
- CVE-2026-16363 — Critical (CVSS 9.8): JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR…
- CVE-2026-1229 — Critical (CVSS 9.8): The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific…
- CVE-2024-36736 — Critical (CVSS 9.8): An issue in the oneflow.permute component of OneFlow-Inc. Oneflow v0.9.1 causes an incorrect calculation when the same…
- CVE-2022-30600 — Critical (CVSS 9.8): A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout…
- CVE-2021-44847 — Critical (CVSS 9.8): A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through…