Hi,

The following vulnerability was published for golang-github-cilium-ebpf.

CVE-2026-10722[0]:
| A vulnerability has been found in cilium ebpf up to 0.21.0. This
| affects the function loadRawSpec of the file btf/btf.go of the
| component LoadCollectionSpec/LoadCollectionSpecFromReader. Such
| manipulation of the argument offset leads to integer overflow. The
| attack can only be performed from a local environment. The exploit
| has been disclosed to the public and may be used. The name of the
| patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be
| applied to remediate this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-10722
https://www.cve.org/CVERecord?id=CVE-2026-10722
[1] https://github.com/cilium/ebpf/issues/2019
[2] https://github.com/cilium/ebpf/pull/2021
[3] https://github.com/cilium/ebpf/commit/533dfc82fd228bfadf42ea7180c39de7d9af47fa

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-github-cilium-ebpf, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139176@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated golang-github-cilium-ebpf package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 30 Jul 2026 00:21:26 +0200
Source: golang-github-cilium-ebpf
Architecture: source
Version: 0.22.0+ds1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1124066 1139176
Changes:
 golang-github-cilium-ebpf (0.22.0+ds1-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream (Closes: #1124066)
     - Mention CVE-2026-10722 fixed in 0.21 (Closes: #1139176)
   * Standards-Version: 4.7.4
   * Drop Priority: optional
   * Drop Rules-Requires-Root: no
   * Bump debian/* copyright years
   * Use watch v5
   * Tighten Files-Excluded to cover all *.{o,elf,bin,sys}
   * Use dh-sequence-golang
   * Refresh patches
   * Use compat 14
   * Tighten DH_GOLANG_EXCLUDES after Files-Excluded change
   * Improve d/copyright and add lrc.config
   * Silence intian
Checksums-Sha1:
 0de3df48d6f64ef5765df5cf1c7e6afdbbbf5a17 2707 golang-github-cilium-ebpf_0.22.0+ds1-1.dsc
 9d6afbb76191e48d34a32b4e5d7cc5e58cff2bfb 2087580 golang-github-cilium-ebpf_0.22.0+ds1.orig.tar.xz
 a5d7eba2c824703bdd2b7e2ce2d8b6fc6d89ffd0 6916 golang-github-cilium-ebpf_0.22.0+ds1-1.debian.tar.xz
 5457d2893a9318a6af7a4049e270ec3326f0150b 4391344 golang-github-cilium-ebpf_0.22.0+ds1-1.git.tar.xz
 dbe5fa580a95741adb5f69c11a66b4b7a8028289 17638 golang-github-cilium-ebpf_0.22.0+ds1-1_source.buildinfo
Checksums-Sha256:
 dd6686db463c376aac598d25d44aca8efcf9dab675e341001be8978e78c8b787 2707 golang-github-cilium-ebpf_0.22.0+ds1-1.dsc
 fb27de908d9ea4f285259989e04811d002574be59f49fda80888570651d666c3 2087580 golang-github-cilium-ebpf_0.22.0+ds1.orig.tar.xz
 86efc41fcd7110f59dc0146e334b132ed6361445e07913ca0fd9bac3f81d9ab8 6916 golang-github-cilium-ebpf_0.22.0+ds1-1.debian.tar.xz
 5f09735c4aca8461a664d83f6f623a5b4519182f5dd20d5b35bbdf11fa9c92fe 4391344 golang-github-cilium-ebpf_0.22.0+ds1-1.git.tar.xz
 f7f72cf6957cb4c671a8005bf452db120fad9cf29367c38fa048a9a0a7b3cb16 17638 golang-github-cilium-ebpf_0.22.0+ds1-1_source.buildinfo
Files:
 78eb44888d661011ee6fd44100f8ae81 2707 golang optional golang-github-cilium-ebpf_0.22.0+ds1-1.dsc
 8a60e94f5542c07058439969626ab21d 2087580 golang optional golang-github-cilium-ebpf_0.22.0+ds1.orig.tar.xz
 95f489dfef82853a256ddb2870ce62c9 6916 golang optional golang-github-cilium-ebpf_0.22.0+ds1-1.debian.tar.xz
 fc6a234bff70e1c0049d33bddef8ea49 4391344 golang None golang-github-cilium-ebpf_0.22.0+ds1-1.git.tar.xz
 a9433547d49dcfcd77d5a180f6b16659 17638 golang optional golang-github-cilium-ebpf_0.22.0+ds1-1_source.buildinfo
Git-Tag-Info: tag=3ebd0e61723dc7b8d5f47e9b58f5305e0e4b7c63 fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmpqhLoACgkQYG0ITkaD
wHmM1xAA3zNhkvqtzFKIpF8VhEjkIkIp3QONOjZwH10yp+pXEZ2FPjc7hJX4mGZB
SnDJxmeSRET3ghEBd747cACVkU4dx6WnKjuf0faWTufXHy9XCCVTjwgQn7KatNJR
Dx/LVUDQrVeptwq5zTqmWNx0tMm2h477wKJSXQkSgT4Yaboe/1B+e2MmK8V1VROk
mhfjvSaYAFeBFVEv3PO1Dyvc98pau3C87cwcgy46tAIltQxU0+/KPAjZrZAlsjbB
A2XtVZjgD6468XdrYfozvCckWseTB7JxaHA7RpFaFgdnWfoBrLLQzrVMjgELEFE/
bHZC5Dd4F0GHA+nW9Dgk7QRJ13gFxDKiIOOesNB28RXTzIumuFgGcMruMoTLAyhs
CeB4ZJWjRKzAutGsoNaAdVrS23gdv1Cfj7V776Ij0uzmJ4dLAWx6HYZ+rT0GTyTr
6YHk0MgVDy+ysm8tyYLu3RqYYcZ+Zmen7aD0Drk/6N8c9Rh8wti+m5kjX3LtGbWz
ILa0hKm+KbJQLr9YM8Ppp+CMHxKnJPSyv8lvRjsCL6MZ3ypg4bhutdQ/O4nXZzh1
aSFvUY5UFjk7c7wgBnSx5Qe7lmW26caf1KDy/ER6XRwg/x9XzC26MLxXzIcJeoQ5
/s64RIb/6hW6QaxHGp09yRC3TvVUK5UW9GD9ObbKgGcvF33qZRM=
=mQGK
-----END PGP SIGNATURE-----