PackageTrack
Sign in Get early access

github.com/cilium/ebpf

v0.22.0 #509 most downloaded on Go modules cilium/ebpf

What this package is like to depend on

Last release 6 days ago

18 Aug 2026

Ships on a steady schedule

a new release about every 2 weeks

Rarely documented

notes for 8 of 36 stable releases

Nothing withdrawn

no release was ever pulled

9 years old

1095 releases · first in 2017

84 releases in the last 12 months

see the full history below

Release timeline

1095 releases · Aug 2017 to Aug 2026
2018 2019 2020 2021 2022 2023 2024 2025 2026
Release Pre-release

Releases

latest 60 of 1095
  1. v0.22.1-0.20260818094235-64ce9bc7c98e 18 Aug 2026 pre-release

    Nothing published for this version

  2. v0.22.1-0.20260813092409-78669a7ae6fe 13 Aug 2026 pre-release

    Nothing published for this version

  3. v0.22.1-0.20260810101029-e3a865be0e4b 10 Aug 2026 pre-release

    Nothing published for this version

  4. v0.22.1-0.20260805183329-5ee0b63f45bf 05 Aug 2026 pre-release

    Nothing published for this version

  5. v0.22.1-0.20260803133407-253a02318f28 03 Aug 2026 pre-release

    Nothing published for this version

  6. v0.22.1-0.20260729132743-1c8132e6c4d4 29 Jul 2026 pre-release

    Nothing published for this version

  7. v0.22.1-0.20260724102944-5ba0b3b27a92 24 Jul 2026 pre-release

    Nothing published for this version

  8. v0.22.1-0.20260724091036-00feb08ae4e5 24 Jul 2026 pre-release

    Nothing published for this version

  9. v0.22.1-0.20260708195611-075392bc812b 08 Jul 2026 pre-release

    Nothing published for this version

  10. v0.22.1-0.20260708150823-a5b2e206f9ed 08 Jul 2026 pre-release

    Nothing published for this version

  11. v0.22.1-0.20260702085604-42f32c14b384 02 Jul 2026 pre-release

    Nothing published for this version

  12. v0.22.1-0.20260629145300-13abcfab7ad3 29 Jun 2026 pre-release

    Nothing published for this version

  13. v0.22.1-0.20260629131901-a7d72cd2e818 29 Jun 2026 pre-release

    Nothing published for this version

  14. v0.22.0 26 Jun 2026
    Release notes

    Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.

    Kernel 7.1 compatibility

    In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.

    See #2042 for details. Special thanks to @Capricornus007 for making the bug report that allowed us to fix this in a timely manner.

    BPF token support

    Some BPF-related actions require the user to have root privileges (CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant it CAP_SYS_ADMIN to avoid privilege escalation if that process gets compromised.

    BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.

    However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.

    See #1953 for more details.

    BTF cache changes

    Package btf used to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache with btf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.

    With this update, we've removed the global cache and the btf.FlushKernelSpec function, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained from btf.NewCache and pass it to NewCollectionWithOptions via CollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.

    See #1988 for more details. Thank you @matthyx for these changes.

    New features

    • btf: print member names of btf.Unions and Structs by @ti-mo in #1967
    • bpf2go: Generate constant names for maps, programs, and variables by @mattijons in #1860
    • Allow link.OpenExecutable for files without executable bit set by @ti-mo in #1982
    • asm: add support for the may_goto insn and JCOND opcode by @mtardy in #1898

    Bug fixes and improvements

    • bpf2go: Improve error message when a C type cannot be resolved by @awandke in #1965
    • btf: reject nil values or interfaces from being added to Builder by @ti-mo in #1966
    • Use os.Getpagesize in tests instead of hardcoded 4k by @shaunduncan in #1970
    • map: avoid misleading error message for storage maps by @venk8 in #1978
    • struct_ops: Refactor struct_ops member population helpers by @shun159 in #1986
    • prog: restore btf.ErrNotFound behaviour of findTargetInKernel by @ti-mo in #1991
    • asm: fix wrong bpf call offset display for jited programs by @wucm667 in #1996
    • internal/kconfig: reject bool arrays for string values by @immanuwell in #2006
    • bpf2go: improve duplicate type name error message by @wucm667 in #1993
    • doc: clarify Address vs Offset on Uprobe/Uretprobe by @Strykar in #2008
    • fix(link): add missing BPF_F_REPLACE flag for RawAttachProgram by @wucm667 in #1995
    • tracefs: discover mount via /proc/self/mountinfo by @yoav-orca in #2004
    • prog.go: cache BTF for CAP_SYS_ADMIN-less freplace by @mejedi in #2011
    • BTF: fixed panics during parsing of malformed input by @dylandreimerink in #2021
    • internal/testutils: Fix capability restoration in WithCapabilities by @dylandreimerink in #2023
    • ebpf: defer batch API probe for batch lookup by @arunsingh in #2018
    • fix: prevent uint32 overflow in struct_ops bounds check by @DARSHANR007 in #2025
    • Improve resilience of ELF parser to malformed input by @dylandreimerink in #2026
    • memory: use unsafe.Add to align unsafe memory instead of uintptr conversion by @ti-mo in #2035
    • fix: reject variable offsets that overflow uint32 bounds by @SAY-5 in #2031

    Miscellaneous changes

    • build(deps): bump requests from 2.32.5 to 2.33.0 in /docs by @dependabot[bot] in #1971
    • docs: disable parallel processing in git date plugin by @ti-mo in #1976
    • build(deps): bump pygments from 2.19.2 to 2.20.0 in /docs by @dependabot[bot] in #1975
    • build(deps): bump the docs group in /docs with 2 updates by @dependabot[bot] in #1977
    • ci: cache qemu-system-x86 dependency by @ti-mo in #1983
    • ci: pin awalsh128/cache-apt-pkgs-action to v1.6.0 by @ti-mo in #1984
    • testutils: rework and improve RunWithToken by @ti-mo in #1989
    • build(deps): bump gitpython from 3.1.46 to 3.1.47 in /docs by @dependabot[bot] in #1992
    • Go 1.25, run go fix in CI, fix nil derefs in reflect usage by @ti-mo in #1998
    • build(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #1997
    • Go: bump golang.org/x/ dependencies by @florianl in #2001
    • build(deps): bump gitpython from 3.1.47 to 3.1.49 in /docs by @dependabot[bot] in #2002
    • build(deps): bump gitpython from 3.1.49 to 3.1.50 in /docs by @dependabot[bot] in #2005
    • Makefile: use go tool for linting by @florianl in #1999
    • ci: split workflows into build+lint and generate+fix by @ti-mo in #2009
    • build(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs by @dependabot[bot] in #2007
    • build(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs by @dependabot[bot] in #2015
    • build(deps): bump idna from 3.11 to 3.15 in /docs by @dependabot[bot] in #2014
    • CODEOWNERS: allow reviewers to merge docs/, add rgo3 to link/ by @ti-mo in #2036

    New Contributors

    Full Changelog: v0.21.0...v0.22.0

    Open source →
  15. v0.21.1-0.20260610091714-970a97d4cdf6 10 Jun 2026 pre-release

    Nothing published for this version

  16. v0.21.1-0.20260609123412-7be98ef83bb9 09 Jun 2026 pre-release

    Nothing published for this version

  17. v0.21.1-0.20260529144250-765fc1db0961 29 May 2026 pre-release

    Nothing published for this version

  18. v0.21.1-0.20260528150835-a27e8269eff3 28 May 2026 pre-release

    Nothing published for this version

  19. v0.21.1-0.20260528111639-9c2eabba4251 28 May 2026 pre-release

    Nothing published for this version

  20. v0.21.1-0.20260528082551-d2ea79aa8f0d 28 May 2026 pre-release

    Nothing published for this version

  21. v0.21.1-0.20260527142033-533dfc82fd22 27 May 2026 pre-release

    Nothing published for this version

  22. v0.21.1-0.20260513145500-dd3e0f047da2 13 May 2026 pre-release

    Nothing published for this version

  23. v0.21.1-0.20260512111231-62e9463556a2 12 May 2026 pre-release

    Nothing published for this version

  24. v0.21.1-0.20260506151213-40dcb65659d0 06 May 2026 pre-release

    Nothing published for this version

  25. v0.21.1-0.20260501093402-9f87aafaeb37 01 May 2026 pre-release

    Nothing published for this version

  26. v0.21.1-0.20260427123516-6bf8ddfd0f0f 27 Apr 2026 pre-release

    Nothing published for this version

  27. v0.21.1-0.20260423102957-c6578184afc6 23 Apr 2026 pre-release

    Nothing published for this version

  28. v0.21.1-0.20260423095950-bb80582e9be9 23 Apr 2026 pre-release

    Nothing published for this version

  29. v0.21.1-0.20260413095610-4c48d03c2ab3 13 Apr 2026 pre-release

    Nothing published for this version

  30. v0.21.1-0.20260413083626-2ede58d0d7b8 13 Apr 2026 pre-release

    Nothing published for this version

  31. v0.21.1-0.20260402071542-dd42f896bfb7 02 Apr 2026 pre-release

    Nothing published for this version

  32. v0.21.1-0.20260331083222-cd96802774d4 31 Mar 2026 pre-release

    Nothing published for this version

  33. v0.21.1-0.20260324101739-e9e7d1ae90ce 24 Mar 2026 pre-release

    Nothing published for this version

  34. v0.21.1-0.20260311130006-d663e4e3c8f3 11 Mar 2026 pre-release

    Nothing published for this version

  35. v0.21.0 05 Mar 2026
    Release notes

    Hi, everyone! The Cilium project is proud to announce v0.21.0 of ebpf-go, our first major 2026 feature release. Please note that this version comes with a few breaking changes for XDP users that may require some intervention based on your use case, so please read the following section carefully before upgrading! We've also removed some long-deprecated APIs.

    Breaking changes

    XDP Attach Type

    This release saw a change to the ELF parsing logic, specifically to XDP programs. Previously, XDP programs had their ProgramSpec.AttachType set to AttachNone. Prompted by upstream changes in Linux 6.18, XDP programs now come with an AttachXDP attach type. This change ensures compatibility with kernels going forward, as well as better interoperability with libbpf-based tools using shared PROG_ARRAY maps.

    tl;dr: Linux 6.18 and later disallows mixing attach types within the same program array.

    If your application uses a pinned program array, you may need to manually change the attach type of your XDP programs to AttachNone before they are loaded to ensure they can still be inserted into maps containing pre-upgrade programs.

    The same goes for BPF links. If you're updating an XDP link created by an older version of ebpf-go, you need to ensure your XDP program is loaded with the same attach type the link was initially created with, or updating will fail with EINVAL.

    For an example of how to deal with this change, here's the the Cilium PR that implemented logic to try both attach types when updating links.

    Windows helper function rename

    ebpf-for-windows was upgraded from 0.21.0 to v1.0.0-rc1. efW made breaking changes to the names of helper functions, our API has been updated to match:

    New Features

    • Struct ops — The ELF reader can now parse struct ops sections, building MapSpecs and resolving function-pointer members. link.AttachStructOps has been added to allow attaching a StructOpsMap as a link. A sched_ext example can be found here.
    • Weak symbol & ELF linking — Programs and maps defined as weak symbols are now fully supported. The ELF reader performs per-symbol decoding for both ProgramSpec and MapSpec, meaning linked objects (produced via bpftool gen object) are now handled correctly.
    • BTF type deduplication — btf.Builder can now deduplicate types while generating a BTF blob. Deduplication can be enabled by passing BuilderOptions to NewBuilder with the Deduplication field set to true.
    • ProgramSpec.Compatible was added — ProgramSpec.Tag is now deprecated. The new ProgramSpec.Compatible method compares a loaded program's tag against both SHA-1 and SHA-256 hashes of the spec, ensuring correct behaviour across kernels — including kernel v6.18+, which switched to SHA-256 for program hashing.
    • ProgramInfo improvements — The program name as reported by ProgramInfo.Name is now sourced from BTF func info when available to provide the full program name if it's longer than 15 bytes.
    • LinkInfo improvements — Added a number of methods and types related to reading back link info.
    • Reverse symbol lookup — Added Executable.Symbol to resolve addresses to a symbol and relative offset.
    • Uprobe/kprobe link feature probing — HaveBPFLinkKprobeMulti, HaveBPFLinkUprobeMulti, and HaveBPFLinkKprobeSession are now exported from the features package, making it easier to probe for multi-attach support before loading programs.
    • Program run batching — A new RunOptions.BatchSize option has been added to support batching when running programs.

    Bug Fixes

    • Allow weak kfuncs loading without CAP_SYS_ADMIN — Loading programs with weak kfuncs on kernels that don't have the kfunc no longer fails with "operation not permitted" when the caller lacks CAP_SYS_ADMIN. The permission error is now treated as "not found" for weak kfuncs.
    • ELF reader nil panic — Fixed a panic that could occur when loading an ELF without BTF due to a nil extInfo pointer. Along with the fix, a suite of regression tests was added that exercises the core loader logic with non-BTF ELFs as well.
    • QueryResult.HaveLinkInfo heuristic — The heuristic has been updated to check for at least one attached program with a non-zero link ID, fixing a false positive introduced by a kernel change that began populating the revision field for cgroup queries.
    • Windows map/program count — Increased the default map and program count on Windows to reduce failures when loading collections with more maps than previously allocated.

    More breaking changes

    Deprecations

    In this release we have removed a number of features which had been deprecated for a while.

    Breaking changes to Memory, Variable and VariableSpec

    Breaking changes to link info

    Breaking changes to BTF API

    We exported methods and types from the btf package. This allowed us to directly assign BTF func info, line info and CO-RE relocations to instructions from outside of the btf package, making some methods unneeded and thus got removed.

    What's Changed

    New Contributors

    Full Changelog: v0.20.0...v0.21.0

    Open source →
  36. v0.20.1-0.20260305092155-a8684889c7ce 05 Mar 2026 pre-release

    Nothing published for this version

  37. v0.20.1-0.20260302154811-8eb4aa9dcd93 02 Mar 2026 pre-release

    Nothing published for this version

  38. v0.20.1-0.20260302134956-1c6b1f6ba11d 02 Mar 2026 pre-release

    Nothing published for this version

  39. v0.20.1-0.20260223134756-e6ab87ebda75 23 Feb 2026 pre-release

    Nothing published for this version

  40. v0.20.1-0.20260218191617-ee67e7f43dd9 18 Feb 2026 pre-release

    Nothing published for this version

  41. v0.20.1-0.20260218124433-3609a64cf7b8 18 Feb 2026 pre-release

    Nothing published for this version

  42. v0.20.1-0.20260217154219-4c375faced1a 17 Feb 2026 pre-release

    Nothing published for this version

  43. v0.20.1-0.20260205091952-2e4cf1cc3c8f 05 Feb 2026 pre-release

    Nothing published for this version

  44. v0.20.1-0.20260202111834-74defddb3335 02 Feb 2026 pre-release

    Nothing published for this version

  45. v0.20.1-0.20260202100435-fd71aa0b4528 02 Feb 2026 pre-release

    Nothing published for this version

  46. v0.20.1-0.20260202090324-14941d2d914b 02 Feb 2026 pre-release

    Nothing published for this version

  47. v0.20.1-0.20260115155834-61c4efeaf4c2 15 Jan 2026 pre-release

    Nothing published for this version

  48. v0.20.1-0.20260114110412-72ba07471dea 14 Jan 2026 pre-release

    Nothing published for this version

  49. v0.20.1-0.20260113163438-83897f7e3f73 13 Jan 2026 pre-release

    Nothing published for this version

  50. v0.20.1-0.20260113132947-8b37f6d4490a 13 Jan 2026 pre-release

    Nothing published for this version

  51. v0.20.1-0.20260113124009-23d8d302018c 13 Jan 2026 pre-release

    Nothing published for this version

  52. v0.20.1-0.20260113095820-b2cad80d0666 13 Jan 2026 pre-release

    Nothing published for this version

  53. v0.20.1-0.20260108141042-f7e80f49188b 08 Jan 2026 pre-release

    Nothing published for this version

  54. v0.20.1-0.20260106151347-015204a03217 06 Jan 2026 pre-release

    Nothing published for this version

  55. v0.20.1-0.20260106100743-439a14d92fb4 06 Jan 2026 pre-release

    Nothing published for this version

  56. v0.20.1-0.20260106090449-ba589ea7394e 06 Jan 2026 pre-release

    Nothing published for this version

  57. v0.20.1-0.20260105133037-17e220fd4745 05 Jan 2026 pre-release

    Nothing published for this version

  58. v0.20.1-0.20251215101449-df5c3096bd8c 15 Dec 2025 pre-release

    Nothing published for this version

  59. v0.20.1-0.20251204155832-f150ced93791 04 Dec 2025 pre-release

    Nothing published for this version

  60. v0.20.1-0.20251201143148-3d4ca808756e 01 Dec 2025 pre-release

    Nothing published for this version

Every package, every release, already written down.

The archive is open and free. Watching your own project is what we are building next.

Browse the archive