PREVAIL’s verifier treats writes to context fields as no‑ops, meaning that an eBPF program designed by an attacker can overwrite a field in the context, then reload that field as a packet pointer and dereference an attacker‑controlled address. The verifier silently accepts the program as safe, which allows the attacker to read or write arbitrary memory, potentially leading to kernel‑level data exposure or code execution. The weakness arises from mismanaging access control on context registers (CWE‑682).

The vulnerability applies to the vbpf:prevail eBPF verifier. All releases prior to version 0.2.4 are susceptible; the fix was incorporated in v0.2.4 and later releases.

The CVSS score of 9.3 signals a severe risk. Because the verifier loads user‑supplied eBPF programs, an attacker can easily construct a malicious program, making exploitation straightforward once the verifier is active. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Until the patch is applied, systems running vulnerable Prevail versions face high likelihood of arbitrary kernel code execution.