Is there a public PoC exploit available for CVE-2026-10722?

Yes, a public proof-of-concept exploit is available for CVE-2026-10722. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10722?

Yes, a patch is available for CVE-2026-10722. Update the affected software to the latest version immediately.

cilium ebpf CVE-2026-10722

Q: What is the CVSS score of CVE-2026-10722?

CVE-2026-10722 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34082 LOW

Integer Overflow or Wraparound (CWE-190)

2026-06-03 VulDB

GHSA-xhgw-qwwf-pg32

Information Disclosure Integer Overflow Cilium Ebpf

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 03, 2026 - 13:22 NVD

3.3 (LOW) 1.9 (LOW)

Source Code Evidence Fetched

Jun 03, 2026 - 12:54 vuln.today

Analysis Generated

Jun 03, 2026 - 12:54 vuln.today

DescriptionCVE.org

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.

AnalysisAI

Integer overflow in the cilium/ebpf Go library (versions up to 0.21.0) allows a local authenticated user to cause an availability impact by supplying crafted BPF Type Format (BTF) data to the LoadCollectionSpec or LoadCollectionSpecFromReader APIs. The flaw resides in the loadRawSpec function where 32-bit header field arithmetic was performed using signed int types, enabling overflow to bypass bounds checks on StringOff, StringLen, TypeOff, and TypeLen fields. No public exploit identified at time of analysis as a KEV listing, though publicly available exploit code exists per VulDB and the CVSS temporal component E:P confirms a proof-of-concept is circulating.

Technical ContextAI

The affected code is in btf/btf.go within the cilium/ebpf Go library, a widely-used package for writing eBPF programs from Go. BTF (BPF Type Format) is a kernel metadata format describing types and debug information for eBPF programs, parsed when loading ELF-based eBPF object files. The root cause (CWE-190: Integer Overflow or Wraparound) is the use of signed int arithmetic when summing 32-bit header fields StringOff+StringLen and TypeOff+TypeLen against the buffer length. On architectures where int is 32 bits, or when the sum wraps, the comparison against the buffer length becomes invalid, bypassing memory bounds checks. The patch (PR #2021, commit 533dfc82) resolves this by casting all operands to uint64 before addition, preventing wraparound. Additional fixes in btf/btf_types.go add a length check against the parsed header remainder, and btf/strings.go adds a null-termination check to prevent unbounded string reads. CPE: cpe:2.3:a:cilium:ebpf:*:*:*:*:*:*:*:*.

RemediationAI

Apply the upstream fix by updating the cilium/ebpf dependency to a version that includes commit 533dfc82fd228bfadf42ea7180c39de7d9af47fa, available via PR #2021 at https://github.com/cilium/ebpf/pull/2021. The exact patched release version tag is not independently confirmed from available data - verify by checking the cilium/ebpf releases page and confirming the commit is included before pinning a version. As a compensating control where patching is immediately impractical, restrict the ability of untrusted or low-privileged local users to supply external BTF data to any application that calls LoadCollectionSpec or LoadCollectionSpecFromReader; applications consuming only internally-generated, trusted BTF objects have significantly reduced exposure. There are no known side effects of applying the uint64 cast fix, as it only tightens bounds validation logic.