Description
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cilium | ebpf | 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.10, 0.11, 0.12, 0.13, 0.14, 0.15, 0.16, 0.17, 0.18, 0.19, 0.20, 0.21.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-cilium-ebpf | 0.22.0+ds1-1 | — |
| Debian 13 | golang-github-cilium-ebpf | No fix yet | — |
| Debian 12 | golang-github-cilium-ebpf | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-cilium-ebpf | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-cilium-ebpf | No fix yet | — |
| Ubuntu 25.10 | golang-github-cilium-ebpf | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-cilium-ebpf | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-cilium-ebpf | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | alloy | 1.17.1-150700.15.23.1 | SUSE-SU-2026:4210-1, SUSE-SU-2026:2824-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | alloy | 1.17.1-160000.1.1 | SUSE-SU-2026:23865-1, SUSE-SU-2026:23853-1, SUSE-SU-2026:22954-1 |
| SLES for SAP 16.0 | amazon-ecs-init | 1.106.0-160000.1.1 | SUSE-SU-2026:23234-1 |
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
| SLES 16.0 | alloy | 1.17.1-160000.1.1 | SUSE-SU-2026:23865-1, SUSE-SU-2026:23853-1, SUSE-SU-2026:22954-1 |
| SLES 16.0 | amazon-ecs-init | 1.106.0-160000.1.1 | SUSE-SU-2026:23234-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | SUSE-SU-2026:23625-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.17.1-1.1 | openSUSE-SU-2026:11165-1 |
| openSUSE Tumbleweed | amazon-ecs-init | 1.106.0-1.1 | openSUSE-SU-2026:11443-1 |
| openSUSE Tumbleweed | cadvisor | 0.60.3-1.1 | openSUSE-SU-2026:11153-1 |
| openSUSE Leap 16.0 | alloy | 1.17.1-160000.1.1 | openSUSE-SU-2026:21899-1, openSUSE-SU-2026:21442-1 |
| openSUSE Leap 16.0 | amazon-ecs-init | 1.106.0-160000.1.1 | openSUSE-SU-2026:21574-1 |
| openSUSE Leap 16.0 | cadvisor | 0.60.3-bp160.1.1 | openSUSE-SU-2026:21265-1 |
| openSUSE Leap 16.0 | ctop | 0.7.7-bp160.2.1 | openSUSE-SU-2026:21379-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260827T195228-160000.1.1 | openSUSE-SU-2026:21761-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | containerd +1 | 2.2.7-1.amzn2023.0.1 | ALAS2023-2026-2131 |
| Amazon Linux 2023 | nerdctl | 2.3.5-1.amzn2023.0.1 | ALAS2023-2026-2129 |
| Amazon Linux 2 | nerdctl | 2.3.5-1.amzn2.0.1 | ALAS2-2026-3903 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cri-o +2 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cilium-1.19-operator-generic | 1.19.7-r7 | — |
| Wolfi rolling | ctop +8 | No fix yet | — |
| Wolfi rolling | ctr-1 +2 | 1.7.34-r7 | — |
| Wolfi rolling | ctr-2 +5 | 2.3.4-r3 | — |
| Wolfi rolling | delve | 1.27.1-r2 | — |
| Wolfi rolling | docker-dind-compat-28 +1 | 28.5.2-r38 | — |
| Wolfi rolling | dockerd-28 | 28.5.2-r32 | — |
| Wolfi rolling | dockerd-29 | 29.7.2-r2 | — |
| Wolfi rolling | falcoctl | 0.13.0-r19 | — |
| Wolfi rolling | gitaly-19.0 +1 | 19.0.8-r1 | — |
| Wolfi rolling | gitaly-19.1 +1 | 19.1.6-r0 | — |
| Wolfi rolling | gitaly-compat-19.1 | 19.1.8-r0 | — |
| Wolfi rolling | hubble | 1.19.4-r12 | — |
| Wolfi rolling | hubble-ui-backend | 0.13.5-r16 | — |
| Wolfi rolling | k3s +1 | 1.36.4.1-r1 | — |
| Wolfi rolling | k3s-1.34 +1 | 1.34.10.1-r3 | — |
| Wolfi rolling | k3s-1.35 +1 | 1.35.8.1-r1 | — |
| Wolfi rolling | kubescape | 4.0.12-r3 | — |
| Wolfi rolling | kubescape-operator | 0.2.162-r2 | — |
| Wolfi rolling | kuma-dp-2.13 | 2.13.11-r0 | — |
| Wolfi rolling | kumactl-2.12 +1 | 2.12.3-r22 | — |
| Wolfi rolling | kumactl-2.13 +1 | 2.13.10-r2 | — |
| Wolfi rolling | nerdctl | 2.3.5-r6 | — |
| Wolfi rolling | runc | 1.5.1-r6 | — |
| Wolfi rolling | runc-1.4 | 1.4.3-r6 | — |
| Wolfi rolling | splunk-otel-collector | 0.158.0-r2 | — |
| Wolfi rolling | splunk-otel-collector-compat | 0.160.0-r0 | — |
| Wolfi rolling | tetra +1 | 1.8.0-r0 | — |
| Wolfi rolling | vitess-23 +1 | 23.0.5-r9 | — |
| Wolfi rolling | vitess-24 +1 | 24.0.2-r13 | — |
| Wolfi rolling | vitess-24-compat | 24.0.3-r7 | — |
| Wolfi rolling | witness | 0.12.0-r5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/cilium/ebpf | < 0.22.0 | 0.22.0 | GHSA-xhgw-qwwf-pg32 |
Advisories 20
- SUSE-SU-2026:23625-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23865-1 Security update for alloy SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23853-1 Security update for alloy SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21899-1 Security update for alloy SUSE / openSUSE Security Updates · Sep 25, 2026
- SUSE-SU-2026:4210-1 Security update for alloy SUSE / openSUSE Security Updates · Sep 16, 2026
- ALAS2023-2026-2129 Moderate: nerdctl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- ALAS2-2026-3903 Moderate: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 14, 2026
- ALAS2023-2026-2131 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 9, 2026
- openSUSE-SU-2026:21761-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 9, 2026
- SUSE-SU-2026:23234-1 Security update for amazon-ecs-init SUSE / openSUSE Security Updates · Aug 27, 2026
- openSUSE-SU-2026:21574-1 Security update for amazon-ecs-init SUSE / openSUSE Security Updates · Aug 14, 2026
- openSUSE-SU-2026:11443-1 amazon-ecs-init-1.106.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 5, 2026
- SUSE-SU-2026:22946-1 Security update for alloy SUSE / openSUSE Security Updates · Jul 29, 2026
- SUSE-SU-2026:22954-1 Security update for alloy SUSE / openSUSE Security Updates · Jul 29, 2026
- openSUSE-SU-2026:21442-1 Security update for alloy SUSE / openSUSE Security Updates · Jul 26, 2026
- openSUSE-SU-2026:21379-1 Security update for ctop SUSE / openSUSE Security Updates · Jul 22, 2026
- SUSE-SU-2026:2824-1 Security update for alloy SUSE / openSUSE Security Updates · Jul 10, 2026
- openSUSE-SU-2026:21265-1 Security update for cadvisor SUSE / openSUSE Security Updates · Jul 9, 2026
- openSUSE-SU-2026:11165-1 alloy-1.17.1-1.1 on GA media SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:11153-1 cadvisor-0.60.3-1.1 on GA media SUSE / openSUSE Security Updates · Jul 1, 2026
References
- VDB-368091 | cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow vdb-entry technical-description
- VDB-368091 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-10722 | CVE Analysis and Report third-party-advisory
- Submit #818291 | Cilium cilium/ebpf v0.19.0-v0.21.0 Denial of Service third-party-advisory
- https://github.com/cilium/ebpf/issues/2019 issue-tracking
- https://github.com/cilium/ebpf/pull/2021 issue-tracking patch
- https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815 exploit
- https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa patch
- https://github.com/cilium/ebpf/ product