eBPF Verifier Discrepancy Revealed: PREVAIL Accepts Safe Code Rejected by Linux Kernel Verifier
Security researchers examining the eBPF verifier encountered a case where two independent static analyzers reached opposite conclusions about the same object file. The program correlated_branch.c from the ebpf-samples repository was accepted by the external verifier PREVAIL yet rejected by the in-kernel Linux verifier during loading via bpftool.
The test was performed on Ubuntu 24.04.1 LTS with kernel Linux 6.14.0-37-generic and clang 18.1.3 targeting the bpf architecture. The XDP function ConvergedBranch first obtains packet boundaries from the context, calls check_packet to verify that at least 14 bytes are available, and only then dereferences the Ethernet header type field at offset 12.
The kernel verifier log shows that the scalar register holding the computed length receives the constraint R2_w=scalar(smin=umin=14,...) after the comparison. However, the pointer stored in r7 is not annotated with a matching packet offset range, causing the subsequent load r3 = *(u16 *)(r7 + 12) to be rejected as an invalid packet access.
In contrast, PREVAIL records the state r7.type=packet packet_size=14 r7.packet_offset=0 after the same check. When the load instruction is reached, the tool evaluates assert valid_access(r7.offset+12, width=2) and permits the read because the offset plus size fits inside the proven 14-byte region.
The root cause is architectural: the kernel verifier treats the length scalar and the packet pointer as separate abstract domains, while PREVAIL preserves relational information across states. When the bounds check was inlined directly in ConvergedBranch instead of being hidden inside check_packet, the kernel verifier successfully accepted the program.
The episode demonstrates that a verifier rejection does not automatically imply the presence of a memory-safety bug. Analysts must examine register states such as R7 pkt(off=0,r=0) to determine whether the required offset range was simply not propagated.
Related articles
Critical ASUS Control Center Enterprise Flaw Allows Remote Root Access via CVE-2026-75754
A critical vulnerability identified as CVE-2026-75754 in ASUS Control Center Enterprise (ACC) carries a maximum CVSS score of 10.0 and enables unauthenticated remote attackers to gain full control of the management server and all connected devices. The flaw stems from a combination of missing authentication on a critical function, a server-side request forgery (SSRF) issue, and hardcoded credentials embedded directly in the software. Attackers can craft a malicious HTTP request to extract the system’s encryption key, activate an SSH service on TCP port 2222, and use fixed credentials to obtain a root shell without any user interaction. Once inside, the attacker can read, modify, or delete data stored in the ACC platform and propagate the compromise across managed servers, PCs, and workstations. All versions of ASUS Control Center Enterprise through 4.0.0.2 are affected. ASUS released a security advisory on September 4, 2026, urging immediate updates to mitigate the risk.
Critical Zero-Day 'StyleSmuggler' Vulnerability Exploited in Adobe Commerce and Magento
A zero-day vulnerability dubbed StyleSmuggler is being actively exploited in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution and install backdoors on e-commerce servers. The flaw allows attackers to inject malicious PHP code into files generated by the platform and then force the template system to process it, with the attack chain triggered during the generation of default transaction failure emails. Exploitation has been observed since September 4 and works even if the email is not successfully sent. Researchers have reproduced the attack on clean installations of versions 2.4.7, 2.4.8, and 2.4.9, as well as on a fully patched Magento 2.4.6-p15 system. After compromise, a Rust-based implant is deployed outside the store directory, masquerading as the process [kworker/u:8:0] and maintained via a cron job that restarts it every five minutes. As of September 6, Adobe had not released a CVE, official patch, or specific workaround, though the next scheduled security update is set for September 8.
N-able Releases Hotfix 4 for Critical N-central RCE Flaw CVE-2026-86218 Now Confirmed Exploited
N-able disclosed a critical vulnerability in its N-central IT operations management platform that allows unauthenticated remote code execution on affected servers. The flaw, tracked as CVE-2026-86218, received the maximum CVSSv4.0 base score of 10.0 and is rated Critical. The company published security advisory information on September 5, 2026, and quickly followed with Hotfix 4 (version 2026.3.1.14) that resolves the issue. Although exploitation was not observed at disclosure, N-able updated the advisory the next day to confirm active exploitation in the wild. The vendor urges customers to apply the hotfix immediately and to monitor for suspicious account creation and scanning activity from specific IP addresses. Earlier hotfixes addressing CVE-2026-86206 and CVE-2026-86207 were superseded by the new release.
Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has released an emergency security update for Adobe Commerce and Magento after discovering a critical zero-day vulnerability that permits remote attackers to execute arbitrary code without authentication. The flaw, tracked as CVE-2026-75650, stems from improper sanitization of special elements in the template engine and carries the maximum CVSSv3.1 base score of 10.0. Adobe rates the issue as Critical and confirms active exploitation in real-world attacks. A hotfix is now available, and the company has assigned the highest priority rating of 1, urging all customers to apply the update within 72 hours. The advisory was published on September 7, 2026, highlighting the need for immediate action due to the severity and confirmed abuse.