CVE-2026-10722 - Vulnerability Details

- cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow

Description

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Published: 2026-06-03

Score: 4.8 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is an integer overflow in the loadRawSpec function of the cilium/ebpf library (up to version 0.21.0). The overflow occurs when parsing BTF specifications and can only be triggered from a local environment. The overflow may lead to undefined behavior, including memory corruption or application crashes, but there is no documented remote code execution or privilege escalation.

Affected Systems

The cilium:ebpf component of Cilium is affected, specifically all releases up to and including version 0.21.0. The vulnerability resides in the file btf/btf.go of the LoadCollectionSpec/LoadCollectionSpecFromReader functions.

Risk and Exploitability

The CVSS score is 4.8, indicating a low severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting low likelihood of exploitation in the wild. Because the attack can only be performed locally, the risk is confined to systems that process untrusted BTF specifications on the local machine. However, local attackers could induce application crashes or potentially corrupt memory, which may be a stepping stone to more serious issues in some contexts.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

cilium

ebpf

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21.0`	affected	—

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the patch corresponding to commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa to the cilium/ebpf repository.
Upgrade cilium/ebpf to a release newer than 0.21.0 that contains the fix.
Restrict or carefully validate any local code that loads BTF specifications to prevent malformed inputs from triggering the overflow.

Generated by OpenCVE AI on June 3, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815
https://github.com/cilium/ebpf/
https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa
https://github.com/cilium/ebpf/issues/2019
https://github.com/cilium/ebpf/pull/2021
https://vuldb.com/cve/CVE-2026-10722
https://vuldb.com/submit/818291
https://vuldb.com/vuln/368091
https://vuldb.com/vuln/368091/cti

History

Wed, 03 Jun 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 03 Jun 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.	A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

Wed, 03 Jun 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Title		cilium ebpf LoadCollectionSpec/LoadCollectionSpecFromReader btf.go loadRawSpec integer overflow
First Time appeared		Cilium Cilium ebpf
Weaknesses		CWE-189 CWE-190
CPEs		cpe:2.3:a:cilium:ebpf::::::::
Vendors & Products		Cilium Cilium ebpf
References		https://gist.github.com/thesmartshadow/256bff0f8042c584f993ace89074a815 https://github.com/cilium/ebpf/ https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa https://github.com/cilium/ebpf/issues/2019 https://github.com/cilium/ebpf/pull/2021 https://vuldb.com/cve/CVE-2026-10722 https://vuldb.com/submit/818291 https://vuldb.com/vuln/368091 https://vuldb.com/vuln/368091/cti
Metrics		cvssV2_0 `{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Cilium Ebpf

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-06-03T10:45:10.269Z

Updated: 2026-06-03T14:07:17.819Z

Reserved: 2026-06-03T05:17:10.007Z

Link: CVE-2026-10722

Vulnrichment

Updated: 2026-06-03T13:13:12.060Z

NVD

Status : Received

Published: 2026-06-03T13:16:19.150

Modified: 2026-06-03T14:16:35.370

Link: CVE-2026-10722

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-03T15:45:36Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object