eBPF works because it only runs programs that pass its own static-analyzer - which basically means programs have to be specifically written for eBPF - you can't just take an arbitrary C program and have it run as an eBPF program.

The restrictions on eBPF programs are... legion, just count all the "No, you can't" answers in the FAQ: https://www.kernel.org/doc/html/latest/bpf/bpf_design_QA.htm...