PREVAIL is an eBPF verifier that incorrectly accepts ALU32 ADD and SUB instructions on pointer-typed registers because it does not check the is64 flag. The zero‑extend arithmetic destroys the upper 32 bits of any pointer, yet the verifier still marks the program as safe. An attacker who can submit an eBPF program for verification can therefore create a program that passes the verifier but corrupts pointer values at runtime, potentially leading to system instability or unexpected behavior. This flaw is classified as CWE‑682 and scores 8.8 on the CVSS scale.

Systems using vbpf's Prevail verifier before version 0.2.4 are affected. The vulnerability exists in the open-source Prevail package developed by vbpf. Any environment that loads eBPF programs into the kernel and relies on Prevail for verification – including most modern Linux distributions that accept unprivileged BPF submissions – could be impacted. Version 0.2.4 and later include the patch that restores the is64 check.

The CVSS score of 8.8 indicates a high severity while the EPSS score is not available, so exploitation likelihood cannot be quantified precisely. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to have the ability to submit arbitrary eBPF programs to the kernel, which is feasible on systems that permit unprivileged loading. Once a malicious eBPF program is accepted, it can corrupt pointers at runtime and cause undefined behavior or crashes.