# CVE-2026-10722: Cilium ebpf integer overflow and panic in BTF parser

Source: https://junglewise.ai/threats/cve-2026-10722-cilium-ebpf-integer-overflow-and-panic-in-btf-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-10722 · Severity: low · CVSS 3.3 · Published 2026-06-03

The cilium ebpf library is used to parse eBPF (extended Berkeley Packet Filter) program metadata from compiled ELF binary files. A flaw in the BTF (BPF Type Format) string table parsing allows malformed ELF files to trigger an integer overflow and cause a denial-of-service crash. This affects any application that loads and parses untrusted or user-supplied eBPF binaries.

Vendors: [Cilium](https://junglewise.ai/threats/vendors/cilium), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-10722 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10722 being exploited in the wild.

**How severe is CVE-2026-10722?** Low severity, with a CVSS score of 3.3, published 3 June 2026.

**Which products and versions are affected?** Cilium Ebpf < 0.22.0; Cilium Ebpf-Go up to 0.21.0; github.com/cilium/ebpf (Go) < 0.22.0, SEMVER:introduced=0,fixed=0.22.0.

**Is there a fix for CVE-2026-10722?** Yes. github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10722 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-10722?** Check whether you run Cilium Ebpf, Cilium Ebpf-Go or github.com/cilium/ebpf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cilium/ebpf (Go): upgrade to 0.22.0 or later

  ```sh
  go get github.com/cilium/ebpf@v0.22.0
  ```


## Technical details

The vulnerability is an integer overflow in the BTF string table offset validation logic within the loadRawSpec function in btf/btf.go. When parsing BTF metadata from ELF files, the code performs a bounds check by adding two 32-bit unsigned integers (header.StringOff + header.StringLen) without promoting them to 64-bit integers first, allowing the sum to overflow. Additionally, the parser incorrectly treats a string offset equal to StringLen as valid when it should be rejected. A malformed BTF record with a crafted string offset causes the parser to panic with "slice bounds out of range" instead of returning a parse error. The attack vector is local, requiring the ability to supply a malicious ELF file to an application that calls LoadCollectionSpec or LoadCollectionSpecFromReader. The fix, available in version 0.22.0, casts the uint32 values to uint64 before addition and adds proper boundary validation.

## Affected products

- cilium ebpf < 0.22.0

## Identifiers

- CVE-2026-10722
- GHSA-xhgw-qwwf-pg32
- GO-2026-6238

## Timeline

- 2026-05-26: disclosed
- 2026-05-27: patched: Fix merged in PR #2021; patch commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa
- 2026-06-03: advisory

## References

- [https://github.com/cilium/ebpf/issues/2019](https://github.com/cilium/ebpf/issues/2019)
- [https://github.com/cilium/ebpf/pull/2021](https://github.com/cilium/ebpf/pull/2021)
- [https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa](https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa)
- [https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815](https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815)
- [https://github.com/cilium/ebpf](https://github.com/cilium/ebpf)