Prevail’s eBPF verifier contains a flaw in the Add operator where the offset variable is not updated when the destination register has a non-singleton typeset. The verifier later relies on this stale offset for bounds checks, allowing an attacker to craft a BPF program that passes verification yet performs out‑of‑bounds memory accesses when executed. This results in kernel memory corruption and the possibility of arbitrary code execution. The weakness is a classic example of incorrect calculation of buffer size or limits (CWE‑682).

All versions of vbpf’s Prevail eBPF verification engine released before v0.2.4 are affected. The vulnerable code resides in the core verifier logic handling register typesets and offset calculations. The patch in v0.2.4 resolves the issue.

The CVSS score of 9.3 classifies this flaw as critical. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but that does not reduce the risk. An attacker who can load a malicious BPF program into the kernel triggers the verifier bug, resulting in a BPF program that runs with kernel privileges and can corrupt memory. The attack requires the ability to submit a custom BPF program; no special reconnaissance or privilege escalation is needed beyond that capability.