Repository navigation
Update module github.com/cilium/ebpf to v0.22.0 [SECURITY] - #577
Open
renovate-update-app[bot] wants to merge 1 commit into
Open
renovate-update-app[bot] wants to merge 1 commit into
renovate-update-app[bot] wants to merge 1 commit into
Conversation
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
![renovatee-approver-stackvista[bot]](https://avatars.githubusercontent.com/u/10511829?s=60&v=4){kind=small}
renovate-update-app
Bot
force-pushed
the
renovate/go-github.com-cilium-ebpf-vulnerability
branch
2 times, most recently
from
October 25, 2026 08:37
b35a2cc to
584ad4b
Compare
renovate-update-app
Bot
force-pushed
the
renovate/go-github.com-cilium-ebpf-vulnerability
branch
from
October 26, 2026 08:45
584ad4b to
2dc52de
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.21.0→v0.22.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader
CVE-2026-10722 / GHSA-xhgw-qwwf-pg32
More information
Details
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader
CVE-2026-10722 / GHSA-xhgw-qwwf-pg32 / GO-2026-6238
More information
Details
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Severity
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:PReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Integer overflow in BTF parsing in github.com/cilium/ebpf
CVE-2026-10722 / GHSA-xhgw-qwwf-pg32 / GO-2026-6238
More information
Details
Integer overflow in BTF parsing in github.com/cilium/ebpf
Severity
Unknown
References
This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).
Release Notes
cilium/ebpf (github.com/cilium/ebpf)
v0.22.0: : Linux 7.1 compat, BPF tokens and vmlinux BTF caching changesCompare Source
Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.
Kernel 7.1 compatibility
In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.
See #2042 for details. Special thanks to @Capricornus007 for making the bug report that allowed us to fix this in a timely manner.
BPF token support
Some BPF-related actions require the user to have root privileges (
CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant itCAP_SYS_ADMINto avoid privilege escalation if that process gets compromised.BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.
However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.
See #1953 for more details.
BTF cache changes
Package
btfused to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache withbtf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.With this update, we've removed the global cache and the
btf.FlushKernelSpecfunction, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained frombtf.NewCacheand pass it toNewCollectionWithOptionsviaCollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.See #1988 for more details. Thank you @matthyx for these changes.
New features
Bug fixes and improvements
Miscellaneous changes
go fixin CI, fix nil derefs in reflect usage by @ti-mo in #1998New Contributors
Full Changelog: cilium/ebpf@v0.21.0...v0.22.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.