cilium ebpf up to 0.21.0 LoadCollectionSpec/LoadCollectionSpecFromReader btf/btf.go loadRawSpec offset integer overflow

Summaryinfo

A vulnerability has been found in cilium ebpf up to 0.21.0 and classified as problematic. This impacts the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Performing a manipulation of the argument offset results in integer overflow. This vulnerability is identified as CVE-2026-10722. The attack is only possible with local access. Additionally, an exploit exists. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability classified as problematic has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. The manipulation of the argument offset with an unknown input leads to a integer overflow vulnerability. CWE is classifying the issue as CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. This is going to have an impact on availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-10722. The exploitability is told to be easy. Attacking locally is a requirement. Technical details and a public exploit are known.

The exploit is shared for download at gist.github.com. It is declared as proof-of-concept.

Applying the patch 533dfc82fd228bfadf42ea7180c39de7d9af47fa is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34082). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• cilium

Name

• ebpf

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21.0

License

• open-source

Website

• Product: https://github.com/cilium/ebpf/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #818291: Cilium cilium/ebpf v0.19.0-v0.21.0 Denial of Service (by alifiras)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion