Digest on ebpf-digest

CVE-2026-64192

Mon, 20 Jul 2026 17:18:22 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

When CONFIG_BPF_LSM=y is set, BPF inode storage maps (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at boot time (e.g. omitted from the “lsm=” boot parameter), lsm_prepare() is never executed for the BPF LSM.

Consequently, the BPF inode security blob offset (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its default compiled size of 8 bytes instead of being updated to a valid offset past the reserved struct rcu_head (typically 16 bytes or more).

CVE-2026-64075

Sun, 19 Jul 2026 16:17:48 +0000

In the Linux kernel, the following vulnerability has been resolved:

fprobe: Fix unregister_fprobe() to wait for RCU grace period

Commit 4346ba1604093 (“fprobe: Rewrite fprobe on function-graph tracer”) changed fprobe to register struct fprobe to an rcu-hlist, but it forgot to wait for RCU GP. Thus there can be use-after-free if the fprobe is released right after unregistering. This can be happened on fprobe event and sample module code.

To fix this issue, add synchronize_rcu() in unregister_fprobe().

CVE-2026-64036

Sun, 19 Jul 2026 16:17:43 +0000

In the Linux kernel, the following vulnerability has been resolved:

cgroup/rstat: validate cpu before css_rstat_cpu() access

css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU.

A BPF iter/cgroup program with CAP_BPF and CAP_PERFMON can pass an invalid cpu value. On an unfixed UBSCAN_BOUNDS test kernel, cpu == 0x7fffffff triggers:

CVE-2026-64024

Sun, 19 Jul 2026 16:17:42 +0000

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()):

min_ttl / min_hopcount check
xfrm policy check
tcp_inbound_hash() MD5/AO mismatch
tcp_filter() eBPF/SO_ATTACH_FILTER drop
th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
tcp_v{4,6}_cookie_check() returning NULL

When a packet is dropped on any of these paths, tcp_tw_isn is left set.

CVE-2026-64025

Sun, 19 Jul 2026 16:17:42 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser’s ownership of the receive queue (commit e91de6afa81c, “bpf: Fix running sk_skb program types with ktls”).

sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival:

CVE-2026-63926

Sun, 19 Jul 2026 16:17:10 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment.

The right fragment offset is page-local, but the code advances it with start, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent.

CVE-2026-63864

Sun, 19 Jul 2026 15:16:53 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf: Propagate error from visit_tailcall_insn

Commit e40f5a6bf88a (“bpf: correct stack liveness for tail calls”) added visit_tailcall_insn() but did not check its return value.

View source

CVE-2026-63865

Sun, 19 Jul 2026 15:16:53 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs.

View source

CVE-2026-63830

Sun, 19 Jul 2026 12:16:56 +0000

In the Linux kernel, the following vulnerability has been resolved:

net: skmsg: preserve sg.copy across SG transforms

The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages.

Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache.

CVE-2026-63809

Sun, 19 Jul 2026 12:16:53 +0000

In the Linux kernel, the following vulnerability has been resolved:

bpf: use kvfree() for replaced sysctl write buffer

proc_sys_call_handler() allocates its temporary sysctl buffer with kvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since kvzalloc() may fall back to vmalloc() for large allocations, freeing that buffer with kfree() is wrong and can corrupt memory.

Use kvfree() to safely handle both kmalloc and kvzalloc()/vmalloc allocations.

The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1-rc5.

cilium/ebpf v0.22.0: Linux 7.1 compat, BPF tokens and vmlinux BTF caching changes

Mon, 29 Jun 2026 07:31:50 +0000

Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.

Kernel 7.1 compatibility

In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.

cilium/ebpf v0.21.0: Struct Ops, Weak Symbols and BTF deduplication

Thu, 05 Mar 2026 15:30:29 +0000

Hi, everyone! The Cilium project is proud to announce v0.21.0 of ebpf-go, our first major 2026 feature release. Please note that this version comes with a few breaking changes for XDP users that may require some intervention based on your use case, so please read the following section carefully before upgrading! We’ve also removed some long-deprecated APIs.

Breaking changes

XDP Attach Type

This release saw a change to the ELF parsing logic, specifically to XDP programs. Previously, XDP programs had their ProgramSpec.AttachType set to AttachNone. Prompted by upstream changes in Linux 6.18, XDP programs now come with an AttachXDP attach type. This change ensures compatibility with kernels going forward, as well as better interoperability with libbpf-based tools using shared PROG_ARRAY maps.

cilium/ebpf v0.20.0

Fri, 31 Oct 2025 13:52:39 +0000

Performance Improvements

btf: Memory-map vmlinux BTF when possible instead of copying to heap (saves several megabytes)
btf: Decode BTF from byte slices instead of io.Reader for better performance
btf: Cache BTF during fixups and target search to avoid loading each blob multiple times
linker: Resolve kernel symbols in a single pass instead of individually
prog: Speed up opening pinned programs by using minimal program info
map: Avoid allocations during PerCPUMap batch lookups (76% faster, 99% fewer allocations)

New Features

btf: Added LoadSplitSpec function for easier use of split-BTF files
btf: Accept empty string tables in BTF data
link: Added Detach() method for explicitly detaching links
map: Preliminary support for arena maps
map: Parse and expose map_extra field in MapSpec (enables bloom filter configuration)
prog: Allow explicit ifindex specification when loading programs
prog: Support getting context output from syscall programs
prog: Allow passing extra targets for CO-RE relocations via ExtraRelocationTargets
bpf2go: Allow multiple commands in BPF2GO_CC environment variable (e.g., ccache clang)
tracefs: Allow hyphens in tracepoint group names
kallsyms: Return ErrRestrictedKernel when reading zero addresses due to kernel.kptr_restrict
info: Return ErrRestrictedKernel when program info is restricted by kernel security settings
prog: Tolerate ErrRestrictedKernel during ksym resolution unless ksyms are required

Bugfixes

ringbuf: Fixed panic when reading after close
btf: Fixed race condition when loading cached kernel/module specs
ringbuf: Fixed 32-bit compatibility by using uintptr for positions
memory: Set cleanup on *Memory instead of **Memory to fix resource leak
link: Fixed concurrent cleanup ordering for perf events and tracefs events

Windows Support Improvements

ringbuf: Added Windows support for ring buffer operations
windows: Fixed compatibility with recent eBPF for Windows changes (XDP_TEST removal, SAMPLE program type)
windows: Enabled Hyper-V support in test VMs
program: Added workaround for eBPF for Windows rejecting empty ContextOut

Breaking Changes

ProgramOptions.KernelModuleTypes removed

The KernelModuleTypes field in ProgramOptions has been removed. In 99% of cases this field should not be necessary anymore. Module BTF should be merged into the vmlinux BTF, as tools like btfhub do.

cilium/ebpf v0.19.0

Thu, 26 Jun 2025 10:47:38 +0000

Major Performance Improvements

This release includes significant performance optimizations across multiple areas:

Lazy BTF Decoding: BTF types are now decoded on-demand rather than all upfront, dramatically reducing memory usage and load times
Faster Object Opening: Opening Maps and Programs from fd/id/pin is significantly faster through minimal info retrieval
Improved Statistics Access: New Program.Stats() method allows querying runtime statistics without fetching full ProgramInfo

CO-RE Improvements

Full Kernel Module Support: CO-RE relocations now work against all kernel modules, not just vmlinux

Build System and Toolchain Updates

LLVM Toolchain: Updated to support LLVM 14, 17, and 20 (dropped LLVM 11 support)

Enhanced Map Support

BTF Declaration Tags: Added MapSpec.Tags field for reading btf_decl_tag attributes set on maps
Better Error Handling: Improved BPF_F_NO_PREALLOC hints and warnings for map types that require this flag

Assembly and Instruction Handling

Atomic Operations: Complete support for all atomic operations beyond just atomic add

Memory and Variable Access

New Accessors: Added accessor methods for values represented by Variable and Memory types

Windows Support Improvements

Path Canonicalization: Fixed pin path handling to work with eBPF for Windows path canonicalization rules

Bug Fixes

Map Batch Operations: Fixed value unmarshaling for partial batch operations in BatchLookup and BatchLookupDelete (#1741)
Assembly Validation: Return InvalidOpCode for StoreImm with DWord size (#1767)
Builtin Function Calls: Allow negative constants for builtin function calls (#1797)
CO-RE Module Types: Perform CO-RE against all kernel module types (#1511)
Pin API: Made WalkDir harder to misuse and added Windows support (#1652)
Struct Layout: Emit structs.HostLayout in GoFormatter (#1686)

Compatibility Notes

Minimum eBPF for Windows: Now requires eBPF for Windows 0.21.0 or later
LLVM 11 Dropped: No longer supports LLVM 11 (required for declaration tag support)

What’s Changed

perf,ringbuf: switch Go build tag by @florianl in https://github.com/cilium/ebpf/pull/1752
pin: make WalkDir harder to misuse and add Windows support by @lmb in https://github.com/cilium/ebpf/pull/1736
examples: remove unnecessary -type flags to bpf2go invocations by @ti-mo in https://github.com/cilium/ebpf/pull/1754
map: unmarshal values for partial batch by @aibor in https://github.com/cilium/ebpf/pull/1742
build(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 by @dependabot in https://github.com/cilium/ebpf/pull/1756
all: require eFW 0.21.0 by @lmb in https://github.com/cilium/ebpf/pull/1759
all: use binary.Append where appropriate by @lmb in https://github.com/cilium/ebpf/pull/1760
btf: use append-style encoding when marshaling by @lmb in https://github.com/cilium/ebpf/pull/1761
ci: ensure build works with GOARCH=wasm by @ti-mo in https://github.com/cilium/ebpf/pull/1757
CI: test on latest ubuntu arm64 by @lmb in https://github.com/cilium/ebpf/pull/1766
asm: Add handling for atomic operations by @dylandreimerink in https://github.com/cilium/ebpf/pull/1751
CI: run tests with -race enabled by @lmb in https://github.com/cilium/ebpf/pull/1770
btf: lazy decoding by @lmb in https://github.com/cilium/ebpf/pull/1763
btf: lazy decoding of string table by @lmb in https://github.com/cilium/ebpf/pull/1772
Typo: BenchmarkInspectorGadget -> BenchmarkInspektorGadget by @burak-ok in https://github.com/cilium/ebpf/pull/1773
build(deps): bump the docs group in /docs with 3 updates by @dependabot in https://github.com/cilium/ebpf/pull/1771
variable: return native Go pointers to bpf map memory by @ti-mo in https://github.com/cilium/ebpf/pull/1607
map: reduce false positives of BPF_F_NO_PREALLOC hint on EINVAL by @ti-mo in https://github.com/cilium/ebpf/pull/1776
ci: fix efW installation by @lmb in https://github.com/cilium/ebpf/pull/1777
bpf2go, btf: emit structs.HostLayout in GoFormatter by @lmb in https://github.com/cilium/ebpf/pull/1769
btf: fix Spec.Copy() for split BTF by @lmb in https://github.com/cilium/ebpf/pull/1775
fix: return InvalidOpCode for StoreImm with DWord size by @Ghostbaby in https://github.com/cilium/ebpf/pull/1768
info: add memlock field to ProgramInfo by @haozhangami in https://github.com/cilium/ebpf/pull/1764
ci: use real staticcheck by @lmb in https://github.com/cilium/ebpf/pull/1779
refactor: use the built-in max/min by @cuishuang in https://github.com/cilium/ebpf/pull/1780
refactor: replace HasPrefix+TrimPrefix with CutPrefix by @carrychair in https://github.com/cilium/ebpf/pull/1784
kfunc: poison all weak kfunc calls if the kernel lacks BTF by @bogushevich in https://github.com/cilium/ebpf/pull/1774
btf: fix TestLoadKernelModuleSpec by @lmb in https://github.com/cilium/ebpf/pull/1787
collection: share kernel BTF when loading a collection by @lmb in https://github.com/cilium/ebpf/pull/1778
build(deps): bump the docs group in /docs with 2 updates by @dependabot in https://github.com/cilium/ebpf/pull/1790
build(deps): bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @dependabot in https://github.com/cilium/ebpf/pull/1789
kallsyms: optimize things a bit by @lmb in https://github.com/cilium/ebpf/pull/1785
ci: fetch efW binaries from completed workflows by @lmb in https://github.com/cilium/ebpf/pull/1793
Optimize New{Map,Program}From{ID,FD} and LoadPinned{Map,Program} by @ti-mo in https://github.com/cilium/ebpf/pull/1791
cmd/bpf2go: Use BPF2GO_CFLAGS instead of BPF2GO_FLAGS by @jrife in https://github.com/cilium/ebpf/pull/1796
bpf2go: import package structs when all structs are typedefs by @RonFed in https://github.com/cilium/ebpf/pull/1798
build(deps): bump requests from 2.32.3 to 2.32.4 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1799
ci: upgrade LLVM to 20.1, drop LLVM 11 by @ti-mo in https://github.com/cilium/ebpf/pull/1800
map: add MapSpec.Tags field for reading btf_decl_tag attributes set on maps by @ti-mo in https://github.com/cilium/ebpf/pull/1801
build(deps): bump urllib3 from 2.4.0 to 2.5.0 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1805
elf_reader: do not panic in loadMapsif ELF file has no BTF by @paulcacheux in https://github.com/cilium/ebpf/pull/1807
program: perform CO-RE against all kmod by @lmb in https://github.com/cilium/ebpf/pull/1794
asm: allow negative constants for builtin function calls by @lmb in https://github.com/cilium/ebpf/pull/1806
btf: introduce caching string table to speed up ext info loading by @paulcacheux in https://github.com/cilium/ebpf/pull/1809
linker: do not error out when there is nothing in /sys/kernel/btf by @paulcacheux in https://github.com/cilium/ebpf/pull/1813

New Contributors

@burak-ok made their first contribution in https://github.com/cilium/ebpf/pull/1773
@haozhangami made their first contribution in https://github.com/cilium/ebpf/pull/1764
@carrychair made their first contribution in https://github.com/cilium/ebpf/pull/1784
@bogushevich made their first contribution in https://github.com/cilium/ebpf/pull/1774
@jrife made their first contribution in https://github.com/cilium/ebpf/pull/1796

Full Changelog: https://github.com/cilium/ebpf/compare/v0.18.0...v0.19.0

cilium/ebpf v0.18.0

Wed, 02 Apr 2025 13:05:31 +0000

Initial Windows Support

This release adds support for eBPF on Windows through the eBPF for Windows runtime. Users must run a recent build of the main branch of eBPF for Windows, version 0.20.0 is not supported.

See the documentation and how to contribute to the Windows port.

Supported:

Basic map and program operations
Support for program loading, including native images (.sys files)
Pin operations use Windows-specific global object table instead of bpffs
Support for retrieving program/attach type from GUID

Not supported:

cilium/ebpf v0.17.3

Wed, 12 Feb 2025 10:03:51 +0000

Fixes for a data race in btf.Spec.Copy (thanks @paulcacheux) and a buffer overflow when running 32-bit user space on a 64-bit kernel (thanks @kolyshkin).

What’s Changed

build(deps): bump the docs group in /docs with 2 updates by @dependabot in https://github.com/cilium/ebpf/pull/1663
build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in https://github.com/cilium/ebpf/pull/1661
docs: upgrade Python version to 3.13 by @ti-mo in https://github.com/cilium/ebpf/pull/1664
build(deps): bump actions/github-script from 6 to 7 by @dependabot in https://github.com/cilium/ebpf/pull/1662
internal/unix: add Errno wrapper for Windows by @lmb in https://github.com/cilium/ebpf/pull/1659
internal/linux: use unix.Auxv by @tklauser in https://github.com/cilium/ebpf/pull/1665
btf: read all line info records at once in parseLineInfoRecords by @paulcacheux in https://github.com/cilium/ebpf/pull/1657
btf: fix data race in (*mutableTypes).copy by @paulcacheux in https://github.com/cilium/ebpf/pull/1673
Fix ksym buffer overflow on 32 bit platforms by @kolyshkin in https://github.com/cilium/ebpf/pull/1660

Full Changelog: https://github.com/cilium/ebpf/compare/v0.17.2...v0.17.3

cilium/ebpf v0.17.2

Tue, 28 Jan 2025 15:15:28 +0000

Another minor release to ship some bug fixes, notably for attaching bpf programs to symbols in kernel modules, and for reusing data sections across multiple Collections.

All users are encouraged to upgrade!

Features

link: support for kprobe session by @olsajiri in https://github.com/cilium/ebpf/pull/1623
bpf2go: optionally add suffix in output file names by @mejedi in https://github.com/cilium/ebpf/pull/1624

Bug Fixes

prog: fix tautological AttachTo condition in ProgramSpec.kernelModule by @brycekahle in https://github.com/cilium/ebpf/pull/1640
map: check MapReplacements compatibility after applying BPF_F_MMAPABLE by @ti-mo in https://github.com/cilium/ebpf/pull/1655

Other Changes

features: make HaveProgramHelper more accurate by @lmb in https://github.com/cilium/ebpf/pull/1641
CI: only allow importing x/sys/unix in internal/unix by @lmb in https://github.com/cilium/ebpf/pull/1648
pin: fix a bunch of fd leaks in tests by @lmb in https://github.com/cilium/ebpf/pull/1651
linker: do not copy instructions when there is no reference in flattenInstructions by @paulcacheux in https://github.com/cilium/ebpf/pull/1647
kallsyms: fix fd leak in AssignAddresses and AssignModules by @lmb in https://github.com/cilium/ebpf/pull/1656
add windows CI by @lmb in https://github.com/cilium/ebpf/pull/1650

Thanks to all who contributed and reported issues!

cilium/ebpf Hotfix: don't retry endlessly on verifier errors on kernels <6.4

Fri, 20 Dec 2024 01:37:44 +0000

During the prior removal of ProgramOptions.LogSize in v0.16, the tests weren’t updated to exercise the retry logic. With the last-minute addition of ProgramOptions.LogSizeStart, a bug was introduced that would cause program loads to retry indefinitely without ever growing the buffer in case of a verifier error on kernels before 6.4. This is now fixed, and the tests were updated to exercise the retry logic.

prog: fix shadowing log size variable in verifier log retry loop by @ti-mo in https://github.com/cilium/ebpf/pull/1635

View source

cilium/ebpf Global Variables, Decl Tags, and package `pin`

Wed, 18 Dec 2024 15:48:54 +0000

Note: the hotfix release 0.17.1 is out. Users are highly encouraged to upgrade.

As we close the door on the year 2024, we’re also wrapping up the ebpf-go v0.17 development cycle. This release represents a large body of work and is our largest feature release since BTF.

Users are, as always, highly encouraged to upgrade, and we’re looking forward to hearing your feedback on the new Global Variables API. We’ve been putting this interface trough its paces internally, along with a few eager community members, and we’re ready to let the wider community make use of it.

cilium/ebpf v0.16.0

Wed, 24 Jul 2024 09:40:43 +0000

program: automatic verifier log sizing and ProgramInfo.RecursionMisses()

For the longest time users had to specify ProgramOptions.LogSize to get the full verifier log for large programs. The library now automatically figures out the correct buffer size to use and the field is deprecated. It will be removed in the next version.

ProgramInfo now exposes how often a program didn’t execute due to recursion limits via RecursionMisses.

perf, ringbuf: better control over wakeups, Flush()

There is a trade off between how fast samples are processed and how much CPU is used. Reading samples as quickly as possible uses more CPU, reading in batches is cheaper.

cilium/ebpf v0.15.0

Mon, 22 Apr 2024 12:30:41 +0000

btf: `bpf_core_type_matches` is now supported

Programs can now use bpf_core_type_matches() for a stricter compatibility check. See https://github.com/cilium/ebpf/pull/1366.

program, btf: improve debuggability when CO-RE or kfunc fixup fails

The library now tries to return a more informative error when loading a program fails due to a failed CO-RE relocation or a missing kfunc. See https://github.com/cilium/ebpf/pull/1402.

btf: synthesise instruction comments into line info

asm.Comment in an instruction’s Source() are now passed to the kernel in the form of BTF line info. See https://github.com/cilium/ebpf/pull/1417.

cilium/ebpf v0.14.0

Wed, 27 Mar 2024 10:54:18 +0000

btf: support for CO-RE relocations against kernel modules

It’s now possible to use CO-RE relocations against types defined in kernel modules. See https://github.com/cilium/ebpf/pull/1300 by @brycekahle.

link: netkit support

The link package now allows attaching to netkit interfaces. See https://github.com/cilium/ebpf/pull/1257 by @hemanthmalla

link: support for iterating links

The new link.Iterator type allows enumerating all BPF links active. See https://github.com/cilium/ebpf/pull/1392 by @mpastyl.

Bugfixes

ringbuf: fixed a bug which can lead to corrupt data on arm64, see https://github.com/cilium/ebpf/pull/1375

Breaking changes

github.com/cilium/ebpf

ProgramOptions is not comparable anymore due to KernelModuleTypes.

github.com/cilium/ebpf/btf

CORERelocate had its singature change once again.

What’s Changed

Add CO-RE support for kernel modules by @brycekahle in https://github.com/cilium/ebpf/pull/1300
Create CONTRIBUTING.md by @sandipanpanda in https://github.com/cilium/ebpf/pull/1361
build(deps): bump golangci/golangci-lint-action from 3.7.0 to 4.0.0 by @dependabot in https://github.com/cilium/ebpf/pull/1362
build(deps): bump mkdocs-material from 9.5.8 to 9.5.12 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1363
test: don’t rely on append() to copy base slice by @ti-mo in https://github.com/cilium/ebpf/pull/1367
Add support for netkit device by @hemanthmalla in https://github.com/cilium/ebpf/pull/1257
docs: update project roles by @lmb in https://github.com/cilium/ebpf/pull/1374
make rgo3 owner of features package by @lmb in https://github.com/cilium/ebpf/pull/1376
ringbuf: replace clamp with min by @lmb in https://github.com/cilium/ebpf/pull/1377
ringbuf: fix corrupt samples on arm64 by @paulcacheux in https://github.com/cilium/ebpf/pull/1375
ringbuf: simplify ringReader by @lmb in https://github.com/cilium/ebpf/pull/1379
CI: increase vm memory to avoid oomkills by @lmb in https://github.com/cilium/ebpf/pull/1378
Add support for weak kfuncs by @dylandreimerink in https://github.com/cilium/ebpf/pull/1364
CODEOWNERS: assign code ownership to florianl, mmat11 and dylandreimerink by @ti-mo in https://github.com/cilium/ebpf/pull/1382
elf_reader_test: Fix CI by disabling the “test_log_fixup” selftest by @dylandreimerink in https://github.com/cilium/ebpf/pull/1385
btf: use recursion in coreAreTypesCompatible by @lmb in https://github.com/cilium/ebpf/pull/1383
link, internal: generate full linkinfo for union subtypes by @rgo3 in https://github.com/cilium/ebpf/pull/1359
gh: do not hide internal/sys/types.go in diffs by @lmb in https://github.com/cilium/ebpf/pull/1388
tests: clean up ClangEndian by @lmb in https://github.com/cilium/ebpf/pull/1389
examples: avoid depending on internal packages by @ti-mo in https://github.com/cilium/ebpf/pull/1289
doc: add DCO by @lmb in https://github.com/cilium/ebpf/pull/1396
Fix GitHub edit link on every page by @remram44 in https://github.com/cilium/ebpf/pull/1393
chore: fix some comments by @majorteach in https://github.com/cilium/ebpf/pull/1391
miscellaneous test fixes by @lmb in https://github.com/cilium/ebpf/pull/1386
link: add Iterator by @mpastyl in https://github.com/cilium/ebpf/pull/1392

New Contributors

@sandipanpanda made their first contribution in https://github.com/cilium/ebpf/pull/1361
@hemanthmalla made their first contribution in https://github.com/cilium/ebpf/pull/1257
@remram44 made their first contribution in https://github.com/cilium/ebpf/pull/1393
@majorteach made their first contribution in https://github.com/cilium/ebpf/pull/1391
@mpastyl made their first contribution in https://github.com/cilium/ebpf/pull/1392

Full Changelog: https://github.com/cilium/ebpf/compare/v0.13.2...v0.14.0

cilium/ebpf v0.13.2

Thu, 22 Feb 2024 18:25:26 +0000

What’s Changed

btf: fix race in mutableTypes.copy by @lmb in https://github.com/cilium/ebpf/pull/1358

Full Changelog: https://github.com/cilium/ebpf/compare/v0.13.1...v0.13.2

View source

cilium/ebpf v0.13.1

Thu, 22 Feb 2024 12:16:04 +0000

What’s Changed

fix trusted “Tag breaking changes” workflow by @paulcacheux in https://github.com/cilium/ebpf/pull/1347
fix: add testcast for PutInteger by @atgane in https://github.com/cilium/ebpf/pull/1323
btf: Take instruction size into account when handling poison relocation by @dylandreimerink in https://github.com/cilium/ebpf/pull/1351
btf: fix race due to concurrent read access by @lmb in https://github.com/cilium/ebpf/pull/1357

New Contributors

@atgane made their first contribution in https://github.com/cilium/ebpf/pull/1323

Full Changelog: https://github.com/cilium/ebpf/compare/v0.13.0...v0.13.1

View source

cilium/ebpf v0.13.0

Thu, 15 Feb 2024 16:44:55 +0000

Faster btf.LoadKernelSpec()

Obtaining the kernel’s BTF used to be very slow and is now very fast. See https://github.com/cilium/ebpf/pull/1235 by @lmb.

TCX

It’s now possible to attach TC programs using the new bpf_link based TCX API. See https://github.com/cilium/ebpf/pull/1163 by @lmb.

UprobeMulti and UretprobeMulti

These are the user-space equivalents to KprobeMulti and Kretprobe multi and allow attaching to a large number of symbols quickly. See https://github.com/cilium/ebpf/pull/1269 by @olsajiri.

Netfilter link

There is now support to attach Netfilter programs using bpf_links. See https://github.com/cilium/ebpf/pull/1313 by @mehrdadrad.

cilium/ebpf v0.12.3

Thu, 09 Nov 2023 15:57:06 +0000

This is a small release to fix an incompatibility with golang.org/x/sys/unix@v0.14.0. There is a variety of performance improvements as well.

What’s Changed

Add Remaining and Size to perf/ring Record by @brycekahle in https://github.com/cilium/ebpf/pull/1167
btf: correct printing size of Int type in bytes by @Asphaltt in https://github.com/cilium/ebpf/pull/1182
collection: Add Assign method by @danobi in https://github.com/cilium/ebpf/pull/1114
add 6.6 to CI by @lmb in https://github.com/cilium/ebpf/pull/1187
docs: add overview for package features by @rgo3 in https://github.com/cilium/ebpf/pull/1164
elf: skip local_kptr_stash libbpf test by @lmb in https://github.com/cilium/ebpf/pull/1190
btf: support both elf and raw BTF in loadKernelSpec by @wxx213 in https://github.com/cilium/ebpf/pull/1177
elf: skip local_kptr_stash_fail test by @lmb in https://github.com/cilium/ebpf/pull/1198
btf, sys: update vmlinux.btf.gz to 6.6 by @lmb in https://github.com/cilium/ebpf/pull/1200
btf: optimize stringTable to speed up vmlinux parsing by @lmb in https://github.com/cilium/ebpf/pull/1203
program: fix LINUX_HAS_SYSCALL_WRAPPER use with bpf_tracing.h by @paulcacheux in https://github.com/cilium/ebpf/pull/1202
btf: Optimize string table for globally increasing offsets by @dylandreimerink in https://github.com/cilium/ebpf/pull/1210
map: include full property diff in ErrMapIncompatible error string by @ti-mo in https://github.com/cilium/ebpf/pull/1212
Add new ISAv4 instructions by @dylandreimerink in https://github.com/cilium/ebpf/pull/1193
asm: cleanups for v4 ISA by @lmb in https://github.com/cilium/ebpf/pull/1214
build(deps): bump mkdocs-material from 9.4.4 to 9.4.7 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1197
build(deps): bump pymdown-extensions from 10.3 to 10.3.1 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1196
build(deps): bump mkdocs-macros-plugin from 1.0.4 to 1.0.5 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1195
build(deps): bump mkdocs-git-revision-date-localized-plugin from 1.2.0 to 1.2.1 in /docs by @dependabot in https://github.com/cilium/ebpf/pull/1194
small speedups during elf loading by @paulcacheux in https://github.com/cilium/ebpf/pull/1207
go.mod: update golang.org/x/sys to latest unreleased version by @tklauser in https://github.com/cilium/ebpf/pull/1215
btf: Optimizing BTF parsing by merging readTypes and inflateRawTypes by @dylandreimerink in https://github.com/cilium/ebpf/pull/1211

New Contributors

@wxx213 made their first contribution in https://github.com/cilium/ebpf/pull/1177

Full Changelog: https://github.com/cilium/ebpf/compare/v0.12.2...v0.12.3

cilium/ebpf v0.12.2

Fri, 20 Oct 2023 14:56:09 +0000

This release fixes unmarshaling from a map operation into a []byte, see #1180. This is a regression in v0.12.0.

We now also properly return an error when the value to unmarshal into is too small, see #1181. This behaviour has existed for a long time.

What’s Changed

btf: stop accessing Spec.types from tests by @lmb in https://github.com/cilium/ebpf/pull/1176
PinType: change from int to uint32 by @ti-mo in https://github.com/cilium/ebpf/pull/1179
example: fix key type of xdp example by @BillyChen1 in https://github.com/cilium/ebpf/pull/1178
sysenc: special case unmarshaling into []byte by @lmb in https://github.com/cilium/ebpf/pull/1180
sysenc: refuse to unmarshal into undersized dst by @lmb in https://github.com/cilium/ebpf/pull/1181

New Contributors

@BillyChen1 made their first contribution in https://github.com/cilium/ebpf/pull/1178

Full Changelog: https://github.com/cilium/ebpf/compare/v0.12.1...v0.12.2

cilium/ebpf v0.12.1

Thu, 19 Oct 2023 13:39:50 +0000

Fixes

Fix ProgramInfo.Instructions failing to decode ExtInfos

A recent change to ProgramInfo.Instructions failed to take a difference between kernel and ELF wire format into account. This meant that retrieving the instructions of a program from the kernel failed with a error.

See #1168, fixed by #1169.

Fix reading auxv on 32-bit platforms

The code to determine the kernel version from vdso has been broken on 32-bit platforms. Note that 32-bit arches are not officially supported to the fix is best effort.

cilium/ebpf v0.12.0

Wed, 11 Oct 2023 13:26:04 +0000

This release requires at least Go 1.20. It is mainly a bugfix release without any expected breaking changes. Map operations have also been made faster on the Go side.

Fixes

Correctly freeze `.rodata` maps

.rodata maps were frozen after programs referring to them were loaded, preventing the verifier from eliminating dead code based on the contents of the .rodata maps. Upgrade if you’re running into odd verifier errors that don’t occur on libbpf.

cilium/ebpf Support for ksym and kfunc

Thu, 06 Jul 2023 12:15:27 +0000

Breaking changes

This release requires at least Go 1.19.

github.com/cilium/ebpf/btf:

Handle.Spec() now takes a base *Spec argument. nil is accepted if the Handle is for vmlinux. If Handle is for a (split BTF) kernel module, pass the result of LoadKernelSpec().
NewHandle() now takes a *Builder instead of a *Spec. Loading BTF into the kernel now goes via a new Builder type. See the ‘Additions’ section below.

github.com/cilium/ebpf/link:

KprobeMultiOptions.Addresses: changed from []uint64 to []uintptr The old API didn’t take 32-bit architectures into account.

Fixes

Work around the kernel rejecting some Datasec

The kernel erroneously rejects Datasec where a Typedef, Volatile, Const, Restrict or typeTag follows a Pointer, Struct, Union or Array. There is now a workaround in place, see https://github.com/cilium/ebpf/pull/954.

cilium/ebpf v0.10.0 - BTF Marshaling

Mon, 16 Jan 2023 13:49:37 +0000

We’re pleased to announce the first ebpf-go release of 2023! There is one breaking change, so please read through the release notes carefully. All users are encouraged to upgrade.

Breaking Changes

Support for BTF marshaling

So far, the library would only load BTF into the kernel that was originally generated by clang or pahole. As of this release, the library will instead marshal btf.Types directly into BTF blobs. For example, it’s now possible to create an ebpf.Map from Go code by populating the MapSpec.Key and .Value fields with the map’s k/v types to make bpftool map dump nicely pretty-print its contents for you.

cilium/ebpf v0.9.3 - Prevent livelocks loading BPF programs while profiling

Fri, 30 Sep 2022 07:51:31 +0000

This is a bugfix release for an endless loop that could occur when running a pprof session while loading a BPF program.

@danobi published an article with a deep-dive into the problem: https://dxuuu.xyz/bpf-go-pprof.html.

If a thread receives a signal while blocked in BPF_PROG_LOAD, the verifier can cooperatively interrupt itself by checking pending signals for the thread and return -EAGAIN from the syscall to request userspace to retry.

During a Go pprof session, threads are routinely sent a SIGPROF to make them dump profiling information, which can lead to a runaway reaction if the program takes longer to verify than the interrupt frequency. To prevent this, the SIGPROF signal is now masked during BPF_PROG_LOAD.

cilium/ebpf v0.9.2

Tue, 20 Sep 2022 08:39:01 +0000

This release contains an important bugfix for users of Program.Test() and .Benchmark(). A kernel change was made that disallows empty packet buffers, with knock-on effects to BPF_PROG_RUN and, as a result, ebpf-go’s detection routine for said feature. Users are strongly encouraged to upgrade. See #788 for more details.

The new features.HaveMapFlag() API was merged in this release, congrats @paulcacheux!

Likewise, the link.K(ret)probeMulti() API was added by @mmat11, bringing blazingly-fast bulk kprobe attachments to kernels 5.18 and newer.

cilium/ebpf v0.9.1

Tue, 19 Jul 2022 10:27:06 +0000

This is mainly a bugfix release, but a few long-deprecated pieces of API were finally removed after cutting v0.9.0.

These should be trivial to fix up, since they were simply moved or replaced by similar interfaces.

Enjoy!

Breaking Changes

Deprecations:
- ebpf.ErrNotExist was removed, as it was an alias to os.ErrNotExist
- Map.ID() in favor of Map.Info().ID()
- Program.ID() in favor of Program.Info().ID()
- Program.Attach() and .Detach() in favor of link.RawAttachProgram() and link.RawDetachProgram() respectively
- link.LoadPinned{Cgroup,Iter,RawLink,NetNs,Freplace} in favor of a single link.LoadPinnedLink()
- link.RawLinkInfo was removed, as it was an alias to link.Info
UprobeOptions.Offset is now a relative field, with the new .Address being an absolute offset.

What’s Changed

Remove API deprecated in v0.8.0 by @lmb in https://github.com/cilium/ebpf/pull/684
program: Add TestWithOptions() API by @danobi in https://github.com/cilium/ebpf/pull/647
prog: Avoid allocating for ctx if ctx not provided by @danobi in https://github.com/cilium/ebpf/pull/687
btf: add Array.Index by @lmb in https://github.com/cilium/ebpf/pull/689
btf: add btfInt by @lmb in https://github.com/cilium/ebpf/pull/690
Add RelativeOffset field to UprobeOptions struct by @mertyildiran in https://github.com/cilium/ebpf/pull/682
program: remove references from ProgramSpec by @lmb in https://github.com/cilium/ebpf/pull/679
map: suggest incorrect MaxEntries on EINVAL by @markpash in https://github.com/cilium/ebpf/pull/697
internal/sys: regenerate types by @florianl in https://github.com/cilium/ebpf/pull/700
link: close tracefs event if perf event cannot be opened by @nashuiliang in https://github.com/cilium/ebpf/pull/699
Revert “.semaphore - workaround to update ca-certificates before apt-get update” by @lmb in https://github.com/cilium/ebpf/pull/703
run-tests: fix shebang to find bash more reliably by @markpash in https://github.com/cilium/ebpf/pull/702
examples: add map in map example by @markpash in https://github.com/cilium/ebpf/pull/696
btf: fix NewHandleFromID and add test by @lmb in https://github.com/cilium/ebpf/pull/704
sycall should be syscall. by @shepf in https://github.com/cilium/ebpf/pull/707
CI: load bpf_testmod in VM by @lmb in https://github.com/cilium/ebpf/pull/709
internal: make VerifierError more succinct by @lmb in https://github.com/cilium/ebpf/pull/688
examples: add example for XDP by @wedaly in https://github.com/cilium/ebpf/pull/706
btf: simplify loadRawSpec by @lmb in https://github.com/cilium/ebpf/pull/708
Remove 4.4 from CI by @lmb in https://github.com/cilium/ebpf/pull/710
map: Do not chec maxEntries for PerfEventArray map by @olsajiri in https://github.com/cilium/ebpf/pull/714
link/kprobe: skip offset test on kernel version > 5.15 by @mmat11 in https://github.com/cilium/ebpf/pull/719
Avoid leaking fds in test suite and NewMapWithOptions() by @ti-mo in https://github.com/cilium/ebpf/pull/725
btf: Add support for loading split BTF by @brb in https://github.com/cilium/ebpf/pull/691
prog: Allow empty data for prog.Test and prog.Run by @danobi in https://github.com/cilium/ebpf/pull/685
internal: avoid sign extension of Statfs_t.Type on 32 bit arches by @lmb in https://github.com/cilium/ebpf/pull/727
link: unify KprobeOptions.Offset and UprobeOptions.Offset by @lmb in https://github.com/cilium/ebpf/pull/694
collection: close all unassigned resources before returning from LoadAndAssign by @ti-mo in https://github.com/cilium/ebpf/pull/724
btf: add Enum.Size by @lmb in https://github.com/cilium/ebpf/pull/735
btf: use ci-kernels to source kernel BTF by @lmb in https://github.com/cilium/ebpf/pull/731
asm: update BPF built-in functions by @rgo3 in https://github.com/cilium/ebpf/pull/734
program: add getter for btf.Handle by @lmb in https://github.com/cilium/ebpf/pull/730
btf: fix NewHandleFromID for kernel modules by @lmb in https://github.com/cilium/ebpf/pull/729
internal: include previous line on BPF context access error by @lmb in https://github.com/cilium/ebpf/pull/733

New Contributors

@danobi made their first contribution in https://github.com/cilium/ebpf/pull/647
@mertyildiran made their first contribution in https://github.com/cilium/ebpf/pull/682
@nashuiliang made their first contribution in https://github.com/cilium/ebpf/pull/699
@shepf made their first contribution in https://github.com/cilium/ebpf/pull/707
@wedaly made their first contribution in https://github.com/cilium/ebpf/pull/706
@olsajiri made their first contribution in https://github.com/cilium/ebpf/pull/714

Full Changelog: https://github.com/cilium/ebpf/compare/v0.9.0...v0.9.1

cilium/ebpf Releasing the BTF package!

Wed, 25 May 2022 16:02:10 +0000

This release makes package btf public, allowing type information embedded in eBPF ELF objects and vmlinux to be read programmatically from Go. This enables use cases like searching and inspecting the kernel’s types and function signatures at runtime, or ensuring alignment between structures defined in Go and C. Package btf stands on its own and does not require adopting other subpackages, potentially making it useful beyond the domain of eBPF. Additionally, parsing BTF was made significantly faster and now consumes less memory.

cilium/ebpf v0.8.1

Mon, 14 Feb 2022 10:25:30 +0000

Fixes

elf_reader: Fix non-determinism in determining prog type by @joamaki in https://github.com/cilium/ebpf/pull/549
Look for Linux note in all elf note sections instead of just the first one by @paulcacheux in https://github.com/cilium/ebpf/pull/560
btf: remove symbol value bounds check to support vmlinux ELFs by @ti-mo in https://github.com/cilium/ebpf/pull/555

New Contributors

@joamaki made their first contribution in https://github.com/cilium/ebpf/pull/549
@paulcacheux made their first contribution in https://github.com/cilium/ebpf/pull/560

Full Changelog: https://github.com/cilium/ebpf/compare/v0.8.0...v0.8.1

View source

cilium/ebpf v0.8.0

Fri, 21 Jan 2022 15:32:46 +0000

We’re happy to announce our first release of 2022!

Breaking Changes

Deprecations
- Deprecate StructOpts and perf.IsClosed() by @ti-mo in https://github.com/cilium/ebpf/pull/547

cmd/bpf2go: strip DWARF info by @lmb in https://github.com/cilium/ebpf/pull/481 DWARF info is now stripped from compiled BPF objects by default when using bpf2go, resulting in significant savings in object size. It can be re-enabled if desired.
elf_reader: emit UnspecifiedPrograms into CollectionSpec by @ti-mo in https://github.com/cilium/ebpf/pull/529 Previously, ProgramSpecs were not emitted to CollectionSpec.Programs if their ELF section names were not recognized. This limitation has been lifted: programs that are explicitly assigned to an ELF section will now always appear in the CollectionSpec, though they will all be of type UnspecifiedProgram. The SectionName field was added to help the user determine program types manually.

cilium/ebpf v0.7.0: Honeygopher Edition

Mon, 11 Oct 2021 12:30:56 +0000

The cilium/ebpf project now has a mascot, the Honeygopher! Thank you, Vadim Shchekoldin!

New Packages

Package ringbuf allows reading from a BPF_MAP_TYPE_RINGBUF map.
Package features implements the equivalent of bpftool feature probe for discovering BPF-related kernel features using native Go. Note that support for probing availability of BPF helpers is pending.
Package rlimit provides a convenient API to lift the RLIMIT_MEMLOCK constraint on kernels before 5.11.

Breaking Changes

Deprecations
- StructOpts has been changed to alias the new StructOpsMap and will be removed in 0.8.0 by @ti-mo in https://github.com/cilium/ebpf/pull/381
- perf.IsClosed() has been deprecated and will be removed in 0.8.0 by @lmb in https://github.com/cilium/ebpf/pull/397
- Collection.Assign() has been removed after a sunset period by @ti-mo in https://github.com/cilium/ebpf/pull/371

Features

elf: support cgroup getsockname/getpeername prog by @zf1575192187 in https://github.com/cilium/ebpf/pull/350
MapType probe API by @rgo3 in https://github.com/cilium/ebpf/pull/321
link/uprobe: support filtering by pid by @mmat11 in https://github.com/cilium/ebpf/pull/342
Add support for freplace programs by @zeffron in https://github.com/cilium/ebpf/pull/288
Export CollectionSpec.ByteOrder by @ti-mo in https://github.com/cilium/ebpf/pull/361
Support ELF map definitions larger than bpf_map_def by @ti-mo in https://github.com/cilium/ebpf/pull/362
Auto-populate tail-call and map-in-map maps from ELF/BTF by @ti-mo in https://github.com/cilium/ebpf/pull/363
features: add HaveProgType API by @rgo3 in https://github.com/cilium/ebpf/pull/355
feature: add call fixups for bpf_probe_read_kernel, etc by @xh4n3 in https://github.com/cilium/ebpf/pull/367
cmd/bpf2go: use Go 1.16 embed to include BPF elfs by @lmb in https://github.com/cilium/ebpf/pull/327
bpf2go: add support for bpf_tracing.h by @lmb in https://github.com/cilium/ebpf/pull/369
features: support get map ids from program. by @arikachen in https://github.com/cilium/ebpf/pull/391
Recognize sk_reuseport programs by @lmb in https://github.com/cilium/ebpf/pull/393
btf: handle float relocation for CO-RE by @lmb in https://github.com/cilium/ebpf/pull/403
Utility function to remove memlock rlimit by @folbricht in https://github.com/cilium/ebpf/pull/392
BPF ring buffer by @mythi in https://github.com/cilium/ebpf/pull/318

Bug Fixes

link/uprobe: handle ENOTSUPP from the kernel’s prepare_uprobe() by @ti-mo in https://github.com/cilium/ebpf/pull/351
Mark PerCPUCGroupStorage as per-cpu by @yadutaf in https://github.com/cilium/ebpf/pull/341
link/kprobe: don’t redeclare a new variable sp by @guodongzz in https://github.com/cilium/ebpf/pull/365
Fix invalid usage of reflect.SliceHeader by @cuonglm in https://github.com/cilium/ebpf/pull/376
program: don’t retrieve map ids by default by @lmb in https://github.com/cilium/ebpf/pull/395
link/uprobe: fix offsets for statically linked binaries by @mmat11 in https://github.com/cilium/ebpf/pull/385
Add sync.Pool to reduce allocations for the default case in unmarshalBytes() by @rockdaboot in https://github.com/cilium/ebpf/pull/420
Fix btf.FindType to avoid copy by @pippolo84 in https://github.com/cilium/ebpf/pull/424
Fix missing close of fds from BPF{ProgLoad,MapCreate} by @pippolo84 in https://github.com/cilium/ebpf/pull/428
Directly handle int32 and int64 types in unmarshalBytes() by @rockdaboot in https://github.com/cilium/ebpf/pull/427

Examples

Add kprobepin example showing how to re-use a pinned map in a BPF prog by @ungureanuvladvictor in https://github.com/cilium/ebpf/pull/364
examples: adapt uretprobe example to the new library version by @mmat11 in https://github.com/cilium/ebpf/pull/389
CI: build examples by @lmb in https://github.com/cilium/ebpf/pull/390
Add a script to update vendored libbpf headers for examples by @markpash in https://github.com/cilium/ebpf/pull/394
Add an example for the RINGBUF map type by @pippolo84 in https://github.com/cilium/ebpf/pull/412
Add a tracepoint example and a percpu example by @hao-lee in https://github.com/cilium/ebpf/pull/402
examples - convert to new rlimit package for memlock removal by @ti-mo in https://github.com/cilium/ebpf/pull/441

New Contributors

@zf1575192187 made their first contribution in https://github.com/cilium/ebpf/pull/350
@sharjeelaziz made their first contribution in https://github.com/cilium/ebpf/pull/349
@zeffron made their first contribution in https://github.com/cilium/ebpf/pull/352
@yadutaf made their first contribution in https://github.com/cilium/ebpf/pull/341
@guodongzz made their first contribution in https://github.com/cilium/ebpf/pull/365
@xh4n3 made their first contribution in https://github.com/cilium/ebpf/pull/367
@cuonglm made their first contribution in https://github.com/cilium/ebpf/pull/376
@mabis made their first contribution in https://github.com/cilium/ebpf/pull/378
@arikachen made their first contribution in https://github.com/cilium/ebpf/pull/391
@markpash made their first contribution in https://github.com/cilium/ebpf/pull/394
@pippolo84 made their first contribution in https://github.com/cilium/ebpf/pull/401
@folbricht made their first contribution in https://github.com/cilium/ebpf/pull/392
@hao-lee made their first contribution in https://github.com/cilium/ebpf/pull/414
@rockdaboot made their first contribution in https://github.com/cilium/ebpf/pull/420
@mehrdadrad made their first contribution in https://github.com/cilium/ebpf/pull/439
@lizrice made their first contribution in https://github.com/cilium/ebpf/pull/442

This release saw a record amount of new contributors! We’d like to wish everyone a warm welcome and thank you all for your support!

cilium/ebpf Wrap SYS_BPF errors, user-provided uprobe offsets, support new map, program and flag types

Mon, 12 Jul 2021 13:01:29 +0000

Breaking changes

None

Features

Return friendly error when creating maps with BPF_F_MMAPABLE or BPF_F_INNER_MAP and the kernel doesn’t support them.
Add support for StructOps, RingBuf, InodeStorage and TaskStorage map types.
Support many new BPF program types added over the course of 2019/2020 in the assembler.
Detect fentry, fmod_ret and fexit programs by their ELF section names.
link: support user-provided offsets for uprobe locations by specifying UprobeOptions.
link: support creating bpf_map_elem iterators
Wrap and propagate all errors generated by SYS_BPF, allowing the caller to retrieve

Bug Fixes

Fix flaky TestMapPin test on Go 1.17beta1

Deprecations

ebpf.ErrNotExist is now an alias to os.ErrNotExist and will be removed in a future release.

Examples

Docstring fixup in kprobe example

Contributors

Chris Tarazi Lorenz Bauer Mattia Meleleo Mikko Ylinen Robin Gögge Tobias Klauser

cilium/ebpf v0.6.1

Fri, 11 Jun 2021 13:21:25 +0000

Breaking changes

None

Features

link.Raw{At,De}tachProgram now wraps and returns the underlying error returned by the kernel. Note: this is not an API contract, so use at your own discretion. This was added temporarily for kernel feature detection purposes, and a proper feature detection API will replace this in the near future.
link.K(ret)probe now automatically prefixes the given symbol with the conventional prefix for syscall wrappers (e.g. __x64_ when running on amd64)

Examples

The kprobe example now hooks the sys_execve syscall wrapper by its common name rather than the x64 variant

Contributors

Aleksa Sarai Lorenz Bauer Nikolay Nikolaev Robin Gögge

Digest on ebpf-digest

CVE-2026-64192

CVE-2026-64075

CVE-2026-64036

CVE-2026-64024

CVE-2026-64025

CVE-2026-63926

CVE-2026-63864

CVE-2026-63865

CVE-2026-63830

CVE-2026-63809

cilium/ebpf v0.22.0: Linux 7.1 compat, BPF tokens and vmlinux BTF caching changes

Kernel 7.1 compatibility

cilium/ebpf v0.21.0: Struct Ops, Weak Symbols and BTF deduplication

Breaking changes

XDP Attach Type

cilium/ebpf v0.20.0

Performance Improvements

New Features

Bugfixes

Windows Support Improvements

Breaking Changes

ProgramOptions.KernelModuleTypes removed

cilium/ebpf v0.19.0

Major Performance Improvements

CO-RE Improvements

Build System and Toolchain Updates

Enhanced Map Support

Assembly and Instruction Handling

Memory and Variable Access

Windows Support Improvements

Bug Fixes

Compatibility Notes

What’s Changed

New Contributors

cilium/ebpf v0.18.0

Initial Windows Support

cilium/ebpf v0.17.3

What’s Changed

cilium/ebpf v0.17.2

Features

Bug Fixes

Other Changes

cilium/ebpf Hotfix: don't retry endlessly on verifier errors on kernels <6.4

cilium/ebpf Global Variables, Decl Tags, and package `pin`

cilium/ebpf v0.16.0

program: automatic verifier log sizing and ProgramInfo.RecursionMisses()

perf, ringbuf: better control over wakeups, Flush()

cilium/ebpf v0.15.0

btf: bpf_core_type_matches is now supported

program, btf: improve debuggability when CO-RE or kfunc fixup fails

btf: synthesise instruction comments into line info

cilium/ebpf v0.14.0

btf: support for CO-RE relocations against kernel modules

link: netkit support

link: support for iterating links

Bugfixes

Breaking changes

github.com/cilium/ebpf

github.com/cilium/ebpf/btf

What’s Changed

New Contributors

cilium/ebpf v0.13.2

What’s Changed

cilium/ebpf v0.13.1

What’s Changed

New Contributors

cilium/ebpf v0.13.0

Faster btf.LoadKernelSpec()

TCX

UprobeMulti and UretprobeMulti

Netfilter link

cilium/ebpf v0.12.3

What’s Changed

New Contributors

cilium/ebpf v0.12.2

What’s Changed

New Contributors

cilium/ebpf v0.12.1

Fixes

btf: `bpf_core_type_matches` is now supported

Correctly freeze `.rodata` maps

cilium/ebpf Support for ksym and kfunc