CVE-2026-10722
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Jun 3, 2026
CISA due date
—
The record
A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go of the component LoadCollectionSpec/LoadCollectionSpecFromReader. Such manipulation of the argument offset leads to integer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. The name of the patch is 533dfc82fd228bfadf42ea7180c39de7d9af47fa. A patch should be applied to remediate this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | alloy | 0 | 1.17.1-1.1 |
| openSUSE:Tumbleweed | cadvisor | 0 | 0.60.3-1.1 |
Related vulnerabilities
- CVE-2026-45686 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-45685 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-45678 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-45682 OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the… Also affects alloy
- CVE-2026-44740 Billy is an interface filesystem abstraction for Go. Also affects alloy
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects alloy
- CVE-2026-25681 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected… Also affects alloy
- CVE-2026-25680 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of… Also affects alloy