Skip to content

chore(deps): update module github.com/cilium/ebpf to v0.22.0 [security] (master) - #132

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-go-github.com-cilium-ebpf-vulnerability
Open

chore(deps): update module github.com/cilium/ebpf to v0.22.0 [security] (master)#132
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/master-go-github.com-cilium-ebpf-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/cilium/ebpf v0.16.0 → v0.22.0 age confidence
github.com/cilium/ebpf v0.7.0 → v0.22.0 age confidence

ebpf-go is vulnerable to integer overflow via LoadCollectionSpecFromReader

CVE-2026-10722 / GHSA-xhgw-qwwf-pg32 / GO-2026-6238

More information

Details

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Severity

  • CVSS Score: 1.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Integer overflow in BTF parsing in github.com/cilium/ebpf

CVE-2026-10722 / GHSA-xhgw-qwwf-pg32 / GO-2026-6238

More information

Details

Integer overflow in BTF parsing in github.com/cilium/ebpf

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

cilium/ebpf (github.com/cilium/ebpf)

v0.22.0: : Linux 7.1 compat, BPF tokens and vmlinux BTF caching changes

Compare Source

Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.

Kernel 7.1 compatibility

In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.

See #​2042 for details. Special thanks to @​Capricornus007 for making the bug report that allowed us to fix this in a timely manner.

BPF token support

Some BPF-related actions require the user to have root privileges (CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant it CAP_SYS_ADMIN to avoid privilege escalation if that process gets compromised.

BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.

However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.

See #​1953 for more details.

BTF cache changes

Package btf used to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache with btf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.

With this update, we've removed the global cache and the btf.FlushKernelSpec function, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained from btf.NewCache and pass it to NewCollectionWithOptions via CollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.

See #​1988 for more details. Thank you @​matthyx for these changes.

New features

Bug fixes and improvements

Miscellaneous changes

New Contributors

Full Changelog: cilium/ebpf@v0.21.0...v0.22.0

v0.21.0: : Struct Ops, Weak Symbols and BTF deduplication

Compare Source

Hi, everyone! The Cilium project is proud to announce v0.21.0 of ebpf-go, our first major 2026 feature release. Please note that this version comes with a few breaking changes for XDP users that may require some intervention based on your use case, so please read the following section carefully before upgrading! We've also removed some long-deprecated APIs.

Breaking changes

XDP Attach Type

This release saw a change to the ELF parsing logic, specifically to XDP programs. Previously, XDP programs had their ProgramSpec.AttachType set to AttachNone. Prompted by upstream changes in Linux 6.18, XDP programs now come with an AttachXDP attach type. This change ensures compatibility with kernels going forward, as well as better interoperability with libbpf-based tools using shared PROG_ARRAY maps.

tl;dr: Linux 6.18 and later disallows mixing attach types within the same program array.

If your application uses a pinned program array, you may need to manually change the attach type of your XDP programs to AttachNone before they are loaded to ensure they can still be inserted into maps containing pre-upgrade programs.

The same goes for BPF links. If you're updating an XDP link created by an older version of ebpf-go, you need to ensure your XDP program is loaded with the same attach type the link was initially created with, or updating will fail with EINVAL.

For an example of how to deal with this change, here's the the Cilium PR that implemented logic to try both attach types when updating links.

Windows helper function rename

ebpf-for-windows was upgraded from 0.21.0 to v1.0.0-rc1. efW made breaking changes to the names of helper functions, our API has been updated to match:

New Features

  • Struct ops — The ELF reader can now parse struct ops sections, building MapSpecs and resolving function-pointer members. link.AttachStructOps has been added to allow attaching a StructOpsMap as a link. A sched_ext example can be found here.
  • Weak symbol & ELF linking — Programs and maps defined as weak symbols are now fully supported. The ELF reader performs per-symbol decoding for both ProgramSpec and MapSpec, meaning linked objects (produced via bpftool gen object) are now handled correctly.
  • BTF type deduplication — btf.Builder can now deduplicate types while generating a BTF blob. Deduplication can be enabled by passing BuilderOptions to NewBuilder with the Deduplication field set to true.
  • ProgramSpec.Compatible was added — ProgramSpec.Tag is now deprecated. The new ProgramSpec.Compatible method compares a loaded program's tag against both SHA-1 and SHA-256 hashes of the spec, ensuring correct behaviour across kernels — including kernel v6.18+, which switched to SHA-256 for program hashing.
  • ProgramInfo improvements — The program name as reported by ProgramInfo.Name is now sourced from BTF func info when available to provide the full program name if it's longer than 15 bytes.
  • LinkInfo improvements — Added a number of methods and types related to reading back link info.
  • Reverse symbol lookup — Added Executable.Symbol to resolve addresses to a symbol and relative offset.
  • Uprobe/kprobe link feature probing — HaveBPFLinkKprobeMulti, HaveBPFLinkUprobeMulti, and HaveBPFLinkKprobeSession are now exported from the features package, making it easier to probe for multi-attach support before loading programs.
  • Program run batching — A new RunOptions.BatchSize option has been added to support batching when running programs.

Bug Fixes

  • Allow weak kfuncs loading without CAP_SYS_ADMIN — Loading programs with weak kfuncs on kernels that don't have the kfunc no longer fails with "operation not permitted" when the caller lacks CAP_SYS_ADMIN. The permission error is now treated as "not found" for weak kfuncs.
  • ELF reader nil panic — Fixed a panic that could occur when loading an ELF without BTF due to a nil extInfo pointer. Along with the fix, a suite of regression tests was added that exercises the core loader logic with non-BTF ELFs as well.
  • QueryResult.HaveLinkInfo heuristic — The heuristic has been updated to check for at least one attached program with a non-zero link ID, fixing a false positive introduced by a kernel change that began populating the revision field for cgroup queries.
  • Windows map/program count — Increased the default map and program count on Windows to reduce failures when loading collections with more maps than previously allocated.

More breaking changes

Deprecations

In this release we have removed a number of features which had been deprecated for a while.

Breaking changes to Memory, Variable and VariableSpec
Breaking changes to link info
Breaking changes to BTF API

We exported methods and types from the btf package. This allowed us to directly assign BTF func info, line info and CO-RE relocations to instructions from outside of the btf package, making some methods unneeded and thus got removed.

What's Changed

New Contributors

Full Changelog: cilium/ebpf@v0.20.0...v0.21.0

v0.20.0

Compare Source

Performance Improvements

  • btf: Memory-map vmlinux BTF when possible instead of copying to heap (saves several megabytes)
  • btf: Decode BTF from byte slices instead of io.Reader for better performance
  • btf: Cache BTF during fixups and target search to avoid loading each blob multiple times
  • linker: Resolve kernel symbols in a single pass instead of individually
  • prog: Speed up opening pinned programs by using minimal program info
  • map: Avoid allocations during PerCPUMap batch lookups (76% faster, 99% fewer allocations)

New Features

  • btf: Added LoadSplitSpec function for easier use of split-BTF files
  • btf: Accept empty string tables in BTF data
  • link: Added Detach() method for explicitly detaching links
  • map: Preliminary support for arena maps
  • map: Parse and expose map_extra field in MapSpec (enables bloom filter configuration)
  • prog: Allow explicit ifindex specification when loading programs
  • prog: Support getting context output from syscall programs
  • prog: Allow passing extra targets for CO-RE relocations via ExtraRelocationTargets
  • bpf2go: Allow multiple commands in BPF2GO_CC environment variable (e.g., ccache clang)
  • tracefs: Allow hyphens in tracepoint group names
  • kallsyms: Return ErrRestrictedKernel when reading zero addresses due to kernel.kptr_restrict
  • info: Return ErrRestrictedKernel when program info is restricted by kernel security settings
  • prog: Tolerate ErrRestrictedKernel during ksym resolution unless ksyms are required

Bugfixes

  • ringbuf: Fixed panic when reading after close
  • btf: Fixed race condition when loading cached kernel/module specs
  • ringbuf: Fixed 32-bit compatibility by using uintptr for positions
  • memory: Set cleanup on *Memory instead of **Memory to fix resource leak
  • link: Fixed concurrent cleanup ordering for perf events and tracefs events

Windows Support Improvements

  • ringbuf: Added Windows support for ring buffer operations
  • windows: Fixed compatibility with recent eBPF for Windows changes (XDP_TEST removal, SAMPLE program type)
  • windows: Enabled Hyper-V support in test VMs
  • program: Added workaround for eBPF for Windows rejecting empty ContextOut

Breaking Changes

ProgramOptions.KernelModuleTypes removed

The KernelModuleTypes field in ProgramOptions has been removed. In 99% of cases this field should not be necessary anymore. Module BTF should be merged into the vmlinux BTF, as tools like btfhub do.

For advanced use cases that still require passing additional BTF specs for CO-RE relocations, use the new ExtraRelocationTargets field:

Before:

opts := &ebpf.ProgramOptions{
    KernelModuleTypes: map[string]*btf.Spec{
        "module1": moduleSpec1,
    },
}

After:

// Merge module BTF into vmlinux BTF (recommended)
// Or for advanced cases:
opts := &ebpf.ProgramOptions{
    ExtraRelocationTargets: []*btf.Spec{
        moduleSpec1,
    },
}
btf.Cache fields unexported

The KernelTypes, ModuleTypes, and LoadedModules fields in btf.Cache have been unexported. These fields were internal implementation details and should not have been accessed directly. Users should continue using btf.NewCache() to create cache instances - no code changes are needed if you weren't directly accessing these fields.

cache := btf.NewCache()
cache.KernelTypes = mySpec  // This will no longer compile

What's Changed

New Contributors

Full Changelog: cilium/ebpf@v0.19.0...v0.20.0

v0.19.0

Compare Source

Major Performance Improvements

This release includes significant performance optimizations across multiple areas:

  • Lazy BTF Decoding: BTF types are now decoded on-demand rather than all upfront, dramatically reducing memory usage and load times
  • Faster Object Opening: Opening Maps and Programs from fd/id/pin is significantly faster through minimal info retrieval
  • Improved Statistics Access: New Program.Stats() method allows querying runtime statistics without fetching full ProgramInfo

CO-RE Improvements

  • Full Kernel Module Support: CO-RE relocations now work against all kernel modules, not just vmlinux

Build System and Toolchain Updates

  • LLVM Toolchain: Updated to support LLVM 14, 17, and 20 (dropped LLVM 11 support)

Enhanced Map Support

  • BTF Declaration Tags: Added MapSpec.Tags field for reading btf_decl_tag attributes set on maps
  • Better Error Handling: Improved BPF_F_NO_PREALLOC hints and warnings for map types that require this flag

Assembly and Instruction Handling

  • Atomic Operations: Complete support for all atomic operations beyond just atomic add

Memory and Variable Access

  • New Accessors: Added accessor methods for values represented by Variable and Memory types

Windows Support Improvements

  • Path Canonicalization: Fixed pin path handling to work with eBPF for Windows path canonicalization rules

Bug Fixes

  • Map Batch Operations: Fixed value unmarshaling for partial batch operations in BatchLookup and BatchLookupDelete (#​1741)
  • Assembly Validation: Return InvalidOpCode for StoreImm with DWord size (#​1767)
  • Builtin Function Calls: Allow negative constants for builtin function calls (#​1797)
  • CO-RE Module Types: Perform CO-RE against all kernel module types (#​1511)
  • Pin API: Made WalkDir harder to misuse and added Windows support (#​1652)
  • Struct Layout: Emit structs.HostLayout in GoFormatter (#​1686)

Compatibility Notes

  • Minimum eBPF for Windows: Now requires eBPF for Windows 0.21.0 or later
  • LLVM 11 Dropped: No longer supports LLVM 11 (required for declaration tag support)

What's Changed

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Asia/Taipei)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from wheatdog as a code owner September 28, 2026 13:10
@renovate
renovate Bot requested review from a team and votdev as code owners September 28, 2026 13:10
@renovate
renovate Bot force-pushed the renovate/master-go-github.com-cilium-ebpf-vulnerability branch 2 times, most recently from 5245618 to e2cbd1e Compare October 5, 2026 13:21
@renovate
chore(deps): update module github.com/cilium/ebpf to v0.22.0 [security]
61c201a 
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot force-pushed the renovate/master-go-github.com-cilium-ebpf-vulnerability branch from e2cbd1e to 61c201a Compare October 20, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wheatdog wheatdog Awaiting requested review from wheatdog wheatdog is a code owner
@votdev votdev Awaiting requested review from votdev votdev is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

needs-review renovate/master

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants