Is CVE-2026-10722 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10722 being exploited in the wild.

How severe is CVE-2026-10722?

Low severity, with a CVSS score of 3.3, published 3 June 2026.

Which products and versions are affected?

Cilium Ebpf < 0.22.0; Cilium Ebpf-Go up to 0.21.0; github.com/cilium/ebpf (Go) < 0.22.0, SEMVER:introduced=0,fixed=0.22.0.

Is there a fix for CVE-2026-10722?

Yes. github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10722 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-10722?

Check whether you run Cilium Ebpf, Cilium Ebpf-Go or github.com/cilium/ebpf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10722: Cilium ebpf integer overflow and panic in BTF parser

Q: Which products and versions are affected?

Cilium Ebpf < 0.22.0; Cilium Ebpf-Go up to 0.21.0; github.com/cilium/ebpf (Go) < 0.22.0, SEMVER:introduced=0,fixed=0.22.0.

Q: Is there a fix for CVE-2026-10722?

Yes. github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-10722 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-10722?

Check whether you run Cilium Ebpf, Cilium Ebpf-Go or github.com/cilium/ebpf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10722 · Severity: low · CVSS 3.3 · Published 2026-06-03

The cilium ebpf library is used to parse eBPF (extended Berkeley Packet Filter) program metadata from compiled ELF binary files. A flaw in the BTF (BPF Type Format) string table parsing allows malformed ELF files to trigger an integer overflow and cause a denial-of-service crash. This affects any application that loads and parses untrusted or user-supplied eBPF binaries.

Vendors: Cilium, Go.

Quick answers

Is CVE-2026-10722 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10722 being exploited in the wild.
How severe is CVE-2026-10722?: Low severity, with a CVSS score of 3.3, published 3 June 2026.
Which products and versions are affected?: Cilium Ebpf < 0.22.0; Cilium Ebpf-Go up to 0.21.0; github.com/cilium/ebpf (Go) < 0.22.0, SEMVER:introduced=0,fixed=0.22.0.
Is there a fix for CVE-2026-10722?: Yes. github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10722 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-10722?: Check whether you run Cilium Ebpf, Cilium Ebpf-Go or github.com/cilium/ebpf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later
```
go get github.com/cilium/ebpf@v0.22.0
```

Technical details

The vulnerability is an integer overflow in the BTF string table offset validation logic within the loadRawSpec function in btf/btf.go. When parsing BTF metadata from ELF files, the code performs a bounds check by adding two 32-bit unsigned integers (header.StringOff + header.StringLen) without promoting them to 64-bit integers first, allowing the sum to overflow. Additionally, the parser incorrectly treats a string offset equal to StringLen as valid when it should be rejected. A malformed BTF record with a crafted string offset causes the parser to panic with "slice bounds out of range" instead of returning a parse error. The attack vector is local, requiring the ability to supply a malicious ELF file to an application that calls LoadCollectionSpec or LoadCollectionSpecFromReader. The fix, available in version 0.22.0, casts the uint32 values to uint64 before addition and adds proper boundary validation.

Affected products

cilium ebpf < 0.22.0

Identifiers

CVE-2026-10722
GHSA-xhgw-qwwf-pg32
GO-2026-6238

Timeline

2026-05-26: disclosed
2026-05-27: patched: Fix merged in PR #2021; patch commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa
2026-06-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.