github.com/cilium/ebpf
v0.22.0
#509 most downloaded on Go modules
cilium/ebpf
What this package is like to depend on
Last release 6 days ago
18 Aug 2026
Ships on a steady schedule
a new release about every 2 weeks
Rarely documented
notes for 8 of 36 stable releases
Nothing withdrawn
no release was ever pulled
9 years old
1095 releases · first in 2017
84 releases in the last 12 months
see the full history below
Release timeline
1095 releases · Aug 2017 to Aug 2026Releases
latest 60 of 1095-
v0.22.1-0.20260818094235-64ce9bc7c98e18 Aug 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260813092409-78669a7ae6fe13 Aug 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260810101029-e3a865be0e4b10 Aug 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260805183329-5ee0b63f45bf05 Aug 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260803133407-253a02318f2803 Aug 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260729132743-1c8132e6c4d429 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260724102944-5ba0b3b27a9224 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260724091036-00feb08ae4e524 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260708195611-075392bc812b08 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260708150823-a5b2e206f9ed08 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260702085604-42f32c14b38402 Jul 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260629145300-13abcfab7ad329 Jun 2026 pre-releaseNothing published for this version
-
v0.22.1-0.20260629131901-a7d72cd2e81829 Jun 2026 pre-releaseNothing published for this version
-
v0.22.026 Jun 2026Release notes
Open source →Hi everyone! Today we announce the v0.22.0 release of ebpf-go. We ship Linux 7.1 compatibility, older versions of the library will not work on 7.1 kernels and above, so please upgrade if you are targeting the latest releases of Linux. We also made a breaking change to BTF caching, please read those notes. And of course a few fixes, improvements and minor features.
Kernel 7.1 compatibility
In kernel 7.1 the BTF header was extended to introduce a new feature called BTF layout. This change caused our BTF parser to fail when parsing vmlinux for this kernel. This has been fixed in this latest release, we recommend upgrading to this latest release to avoid breakage on 7.1 and newer kernels.
See #2042 for details. Special thanks to @Capricornus007 for making the bug report that allowed us to fix this in a timely manner.
BPF token support
Some BPF-related actions require the user to have root privileges (
CAP_SYS_ADMIN). One example is loading and attaching programs that can inspect kernel memory. In some environments, you may want to permit a known good process to load such BPF programs, but you don't want to grant itCAP_SYS_ADMINto avoid privilege escalation if that process gets compromised.BPF tokens are a mechanism that allows a privileged process to delegate fine-grained BPF capabilities to an unprivileged process. The process of delegating is complex and typically handled by a container runtime such as LXC or a process manager like systemd. This part of the handshake is currently out of scope of ebpf-go, as the library is not in charge of process creation where this delegation takes place.
However, the consuming side is what's included in this release. ebpf-go will automatically detect when the current process is running in a namespace where a BPF token is provided, and will automatically try to obtain an use it for interacting with the BPF syscall. Unlike libbpf, this currently requires no extra configuration on behalf of the application.
See #1953 for more details.
BTF cache changes
Package
btfused to cache kernel (vmlinux) BTF specs globally. This is a significant time gain when loading multiple Collections in a row. However, doing so comes at a fairly significant memory cost (~20 MiB), so users could flush this cache withbtf.FlushKernelSpec. Unfortunately, the caching behaviour being opt-out means users would typically discover it while investigating memory usage, and would then have to find an appropriate time during execution to call the flush function. This was always a band-aid for something we didn't have a clear solution to.With this update, we've removed the global cache and the
btf.FlushKernelSpecfunction, which may slow down subsequent collection loading on busy systems. To opt back in, users can now maintain their own cache object, obtained frombtf.NewCacheand pass it toNewCollectionWithOptionsviaCollectionOptions.Cache. Typically, you would put this in a global variable in a bpf-related package in your application, or keep it around in function scope if you load multiple collections in a row.See #1988 for more details. Thank you @matthyx for these changes.
New features
- btf: print member names of btf.Unions and Structs by @ti-mo in #1967
- bpf2go: Generate constant names for maps, programs, and variables by @mattijons in #1860
- Allow link.OpenExecutable for files without executable bit set by @ti-mo in #1982
- asm: add support for the may_goto insn and JCOND opcode by @mtardy in #1898
Bug fixes and improvements
- bpf2go: Improve error message when a C type cannot be resolved by @awandke in #1965
- btf: reject nil values or interfaces from being added to Builder by @ti-mo in #1966
- Use os.Getpagesize in tests instead of hardcoded 4k by @shaunduncan in #1970
- map: avoid misleading error message for storage maps by @venk8 in #1978
- struct_ops: Refactor struct_ops member population helpers by @shun159 in #1986
- prog: restore btf.ErrNotFound behaviour of findTargetInKernel by @ti-mo in #1991
- asm: fix wrong bpf call offset display for jited programs by @wucm667 in #1996
- internal/kconfig: reject bool arrays for string values by @immanuwell in #2006
- bpf2go: improve duplicate type name error message by @wucm667 in #1993
- doc: clarify Address vs Offset on Uprobe/Uretprobe by @Strykar in #2008
- fix(link): add missing BPF_F_REPLACE flag for RawAttachProgram by @wucm667 in #1995
- tracefs: discover mount via /proc/self/mountinfo by @yoav-orca in #2004
- prog.go: cache BTF for CAP_SYS_ADMIN-less freplace by @mejedi in #2011
- BTF: fixed panics during parsing of malformed input by @dylandreimerink in #2021
- internal/testutils: Fix capability restoration in WithCapabilities by @dylandreimerink in #2023
- ebpf: defer batch API probe for batch lookup by @arunsingh in #2018
- fix: prevent uint32 overflow in struct_ops bounds check by @DARSHANR007 in #2025
- Improve resilience of ELF parser to malformed input by @dylandreimerink in #2026
- memory: use unsafe.Add to align unsafe memory instead of uintptr conversion by @ti-mo in #2035
- fix: reject variable offsets that overflow uint32 bounds by @SAY-5 in #2031
Miscellaneous changes
- build(deps): bump requests from 2.32.5 to 2.33.0 in /docs by @dependabot[bot] in #1971
- docs: disable parallel processing in git date plugin by @ti-mo in #1976
- build(deps): bump pygments from 2.19.2 to 2.20.0 in /docs by @dependabot[bot] in #1975
- build(deps): bump the docs group in /docs with 2 updates by @dependabot[bot] in #1977
- ci: cache qemu-system-x86 dependency by @ti-mo in #1983
- ci: pin awalsh128/cache-apt-pkgs-action to v1.6.0 by @ti-mo in #1984
- testutils: rework and improve RunWithToken by @ti-mo in #1989
- build(deps): bump gitpython from 3.1.46 to 3.1.47 in /docs by @dependabot[bot] in #1992
- Go 1.25, run
go fixin CI, fix nil derefs in reflect usage by @ti-mo in #1998 - build(deps): bump actions/github-script from 8 to 9 by @dependabot[bot] in #1997
- Go: bump golang.org/x/ dependencies by @florianl in #2001
- build(deps): bump gitpython from 3.1.47 to 3.1.49 in /docs by @dependabot[bot] in #2002
- build(deps): bump gitpython from 3.1.49 to 3.1.50 in /docs by @dependabot[bot] in #2005
- Makefile: use go tool for linting by @florianl in #1999
- ci: split workflows into build+lint and generate+fix by @ti-mo in #2009
- build(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs by @dependabot[bot] in #2007
- build(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs by @dependabot[bot] in #2015
- build(deps): bump idna from 3.11 to 3.15 in /docs by @dependabot[bot] in #2014
- CODEOWNERS: allow reviewers to merge docs/, add rgo3 to link/ by @ti-mo in #2036
New Contributors
- @awandke made their first contribution in #1965
- @shaunduncan made their first contribution in #1970
- @mattijons made their first contribution in #1860
- @venk8 made their first contribution in #1978
- @wucm667 made their first contribution in #1996
- @immanuwell made their first contribution in #2006
- @Strykar made their first contribution in #2008
- @yoav-orca made their first contribution in #2004
- @matthyx made their first contribution in #1988
- @arunsingh made their first contribution in #2018
- @DARSHANR007 made their first contribution in #2025
- @SAY-5 made their first contribution in #2031
Full Changelog: v0.21.0...v0.22.0
-
v0.21.1-0.20260610091714-970a97d4cdf610 Jun 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260609123412-7be98ef83bb909 Jun 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260529144250-765fc1db096129 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260528150835-a27e8269eff328 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260528111639-9c2eabba425128 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260528082551-d2ea79aa8f0d28 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260527142033-533dfc82fd2227 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260513145500-dd3e0f047da213 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260512111231-62e9463556a212 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260506151213-40dcb65659d006 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260501093402-9f87aafaeb3701 May 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260427123516-6bf8ddfd0f0f27 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260423102957-c6578184afc623 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260423095950-bb80582e9be923 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260413095610-4c48d03c2ab313 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260413083626-2ede58d0d7b813 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260402071542-dd42f896bfb702 Apr 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260331083222-cd96802774d431 Mar 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260324101739-e9e7d1ae90ce24 Mar 2026 pre-releaseNothing published for this version
-
v0.21.1-0.20260311130006-d663e4e3c8f311 Mar 2026 pre-releaseNothing published for this version
-
v0.21.005 Mar 2026Release notes
Open source →Hi, everyone! The Cilium project is proud to announce v0.21.0 of ebpf-go, our first major 2026 feature release. Please note that this version comes with a few breaking changes for XDP users that may require some intervention based on your use case, so please read the following section carefully before upgrading! We've also removed some long-deprecated APIs.
Breaking changes
XDP Attach Type
This release saw a change to the ELF parsing logic, specifically to XDP programs. Previously, XDP programs had their
ProgramSpec.AttachTypeset toAttachNone. Prompted by upstream changes in Linux 6.18, XDP programs now come with anAttachXDPattach type. This change ensures compatibility with kernels going forward, as well as better interoperability with libbpf-based tools using shared PROG_ARRAY maps.tl;dr: Linux 6.18 and later disallows mixing attach types within the same program array.
If your application uses a pinned program array, you may need to manually change the attach type of your XDP programs to
AttachNonebefore they are loaded to ensure they can still be inserted into maps containing pre-upgrade programs.The same goes for BPF links. If you're updating an XDP link created by an older version of ebpf-go, you need to ensure your XDP program is loaded with the same attach type the link was initially created with, or updating will fail with EINVAL.
For an example of how to deal with this change, here's the the Cilium PR that implemented logic to try both attach types when updating links.
Windows helper function rename
ebpf-for-windows was upgraded from
0.21.0tov1.0.0-rc1. efW made breaking changes to the names of helper functions, our API has been updated to match:asm.WindowsFnMemcmp->asm.WindowsFnMemcmpSasm.WindowsFnMemcpy->asm.WindowsFnMemcpySasm.WindowsFnMemmove->asm.WindowsFnMemmoveS
New Features
- Struct ops — The ELF reader can now parse struct ops sections, building
MapSpecsand resolving function-pointer members.link.AttachStructOpshas been added to allow attaching aStructOpsMapas a link. A sched_ext example can be found here. - Weak symbol & ELF linking — Programs and maps defined as weak symbols are now fully supported. The ELF reader performs per-symbol decoding for both
ProgramSpecandMapSpec, meaning linked objects (produced viabpftool gen object) are now handled correctly. - BTF type deduplication —
btf.Buildercan now deduplicate types while generating a BTF blob. Deduplication can be enabled by passingBuilderOptionstoNewBuilderwith theDeduplicationfield set to true. ProgramSpec.Compatiblewas added —ProgramSpec.Tagis now deprecated. The newProgramSpec.Compatiblemethod compares a loaded program's tag against both SHA-1 and SHA-256 hashes of the spec, ensuring correct behaviour across kernels — including kernel v6.18+, which switched to SHA-256 for program hashing.- ProgramInfo improvements — The program name as reported by
ProgramInfo.Nameis now sourced from BTF func info when available to provide the full program name if it's longer than 15 bytes. - LinkInfo improvements — Added a number of methods and types related to reading back link info.
- Reverse symbol lookup — Added
Executable.Symbolto resolve addresses to a symbol and relative offset. - Uprobe/kprobe link feature probing —
HaveBPFLinkKprobeMulti,HaveBPFLinkUprobeMulti, andHaveBPFLinkKprobeSessionare now exported from the features package, making it easier to probe for multi-attach support before loading programs. - Program run batching — A new
RunOptions.BatchSizeoption has been added to support batching when running programs.
Bug Fixes
- Allow weak kfuncs loading without
CAP_SYS_ADMIN— Loading programs with weak kfuncs on kernels that don't have the kfunc no longer fails with "operation not permitted" when the caller lacksCAP_SYS_ADMIN. The permission error is now treated as "not found" for weak kfuncs. - ELF reader nil panic — Fixed a panic that could occur when loading an ELF without BTF due to a nil extInfo pointer. Along with the fix, a suite of regression tests was added that exercises the core loader logic with non-BTF ELFs as well.
QueryResult.HaveLinkInfoheuristic — The heuristic has been updated to check for at least one attached program with a non-zero link ID, fixing a false positive introduced by a kernel change that began populating the revision field for cgroup queries.- Windows map/program count — Increased the default map and program count on Windows to reduce failures when loading collections with more maps than previously allocated.
More breaking changes
Deprecations
In this release we have removed a number of features which had been deprecated for a while.
CollectionSpec.RewriteMaps- PassCollectionOptions.MapReplacementswhen loading the Collection
instead.CollectionSpec.RewriteConstants- UseCollectionSpec.Variablesinstead.NewLinkFromFD- UseNewFromFDinstead.HaveProgType- UseHaveProgramTypeinstead.IsUnreferencedSymbol- Useerrors.Is(err, asm.ErrUnreferencedSymbol)instead.Instruction.RewriteMapPtr- UseInstruction.AssociateMapinstead. If you cannot provide a Map, wrap an fd in a type implementingFDer.Instruction.Sym- UseInstruction.WithSymbolinstead.Instruction.MapPtr- UseInstruction.Mapinstead.
Breaking changes to Memory, Variable and VariableSpec
Memory.Sizenow returns anuint32instead of anintVariable.Sizenow returns anuint32instead of anuint64VariableSpec.MapNamehas been removed, useVariableSpec.SectionNameinstead.VariableSpec.Offsetis no longer a method, and is now a field.VariableSpec.Sizenow returns anuint32instead of auint64.VariableSpec.Typeis no longer a method, and is now a field.
Breaking changes to link info
KprobeInfo.Addresshas been changed from a method into a field.KprobeInfo.Missedhas been changed from a method into a field.KprobeMultiInfo.AddressCounthas been removed, uselen(KprobeMultiInfo.Address)instead.KprobeMultiInfo.Flagshas been changed from a method into a field.KprobeMultiInfo.Missedhas been changed from a method into a field.NetNsInfo.NetnsInowas renamed toNetNsInfo.NetnsInodeNetfilterInfo.Hooknumhas been renamed toNetfilterInfo.Hookand changed from anuint32to aNetfilterInetHookNetfilterInfo.Pfhas been renamed toNetfilterInfo.ProtocolFamilyand changed from anuint32to aNetfilterProtocolFamilyTracingInfo.TargetObjIdhas been renamed toNetfilterInfo.TargetObjectId
Breaking changes to BTF API
We exported methods and types from the btf package. This allowed us to directly assign BTF func info, line info and CO-RE relocations to instructions from outside of the btf package, making some methods unneeded and thus got removed.
ExtInfos.Assignhas been removed, useWithFuncMetadata,Instruction.WithSource, andWithCORERelocationMetadatainstead.AssignMetadataToInstructionshas been removed, useWithFuncMetadata,Instruction.WithSource, andWithCORERelocationMetadatainstead.CORERelocationInfoswas renamed toCORERelocationOffsets.NewBuildernow takes an additionalBuilderOptions. This can be leftnil.
What's Changed
- elf_reader: add struct_ops support by @shun159 in #1869
- link: use PlatformPrefix in TestKprobeMultiProgramCall by @lmb in #1890
- link: change QueryResult.HaveLinkInfo heuristic by @ti-mo in #1892
- link: add StructOpsMap support by @shun159 in #1844
- windows: Increase default map count in call to ebpf_object_load_native_by_fds by @ExceptionalHandler in #1887
- examples: Add a minimal sched_ext example by @shun159 in #1895
- ci: use tagged efW releases by @lmb in #1899
- feat: read full program name from function info by @secDre4mer in #1889
- Improve handling of external dependencies by @lmb in #1897
- examples: Do not override imported namespace with variable by @isodude in #1901
- Add codeowner for windows specific code by @lmb in #1893
- fix: splitting the modification and the return statement by @yrpang in #1909
- features: export link features by @ajwerner in #1906
- Deprecate All The Things by @ti-mo in #1894
- deps: use github.com mirror of linux-stable by @lmb in #1912
- ci: update efW to 1.0.0-rc2 by @lmb in #1911
- Allow callers to create VariableSpecs by @lmb in #1882
- feat: support program run batching with new BatchSize option by @takehaya in #1914
- btf/testdata: Update vmlinux and btf_testmod to latest by @dylandreimerink in #1928
- test: Separate the netns for netkitanchor by @Jack-R-lantern in #1913
- Update CI kernel to v6.18 and fix tests by @dylandreimerink in #1933
- Deprecate
ProgramSpec.Tag, and introduceProgramSpec.Compatibleby @dylandreimerink in #1932 - fix(elf): set attach_type to BPF_XDP for XDP section by @chantra in #1919
- elf: drop legacy non-libbpf xdp* and seccomp attach types by @ti-mo in #1934
- btf: Add type deduplication by @dylandreimerink in #1903
- uprobe: only verify ELF if required by @RonFed in #1938
- ringbuf: add poller and eventRing interfaces by @HueCodes in #1945
- feat: more link inspection support by @secDre4mer in #1896
- btf/testdata: Update vmlinux blob by @dylandreimerink in #1954
- Support BPF object linking by @dylandreimerink in #1942
- elf_reader: add tests for ELF objects without BTF by @puwun in #1939
- Allow loading weak kfuncs without
CAP_SYS_ADMINby @dylandreimerink in #1950
New Contributors
- @ExceptionalHandler made their first contribution in #1887
- @secDre4mer made their first contribution in #1889
- @isodude made their first contribution in #1901
- @yrpang made their first contribution in #1909
- @ajwerner made their first contribution in #1906
- @takehaya made their first contribution in #1914
- @Jack-R-lantern made their first contribution in #1913
- @chantra made their first contribution in #1919
- @HueCodes made their first contribution in #1945
- @puwun made their first contribution in #1939
Full Changelog: v0.20.0...v0.21.0
-
v0.20.1-0.20260305092155-a8684889c7ce05 Mar 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260302154811-8eb4aa9dcd9302 Mar 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260302134956-1c6b1f6ba11d02 Mar 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260223134756-e6ab87ebda7523 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260218191617-ee67e7f43dd918 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260218124433-3609a64cf7b818 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260217154219-4c375faced1a17 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260205091952-2e4cf1cc3c8f05 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260202111834-74defddb333502 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260202100435-fd71aa0b452802 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260202090324-14941d2d914b02 Feb 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260115155834-61c4efeaf4c215 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260114110412-72ba07471dea14 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260113163438-83897f7e3f7313 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260113132947-8b37f6d4490a13 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260113124009-23d8d302018c13 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260113095820-b2cad80d066613 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260108141042-f7e80f49188b08 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260106151347-015204a0321706 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260106100743-439a14d92fb406 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260106090449-ba589ea7394e06 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20260105133037-17e220fd474505 Jan 2026 pre-releaseNothing published for this version
-
v0.20.1-0.20251215101449-df5c3096bd8c15 Dec 2025 pre-releaseNothing published for this version
-
v0.20.1-0.20251204155832-f150ced9379104 Dec 2025 pre-releaseNothing published for this version
-
v0.20.1-0.20251201143148-3d4ca808756e01 Dec 2025 pre-releaseNothing published for this version