{"record":{"id":"b5452a511a9cddf8","repo":"cilium/cilium","slug":"require-support-for-bpf-skb-change-head-linux-5","errorCode":null,"errorMessage":"Require support for bpf_skb_change_head() (Linux 5.8.0 or newer)","messagePattern":"Require support for bpf_skb_change_head\\(\\) \\(Linux 5\\.8\\.0 or newer\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/datapath/linux/requirements.go","lineNumber":127,"sourceCode":"\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkAssign) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_sk_assign() (Linux 5.7.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnGetCgroupClassid) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_get_cgroup_classid() (Linux 5.7.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnPerfEventOutput) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_perf_event_output() (Linux 5.7.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnCsumLevel) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_csum_level() (Linux 5.8.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeHead) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_skb_change_head() (Linux 5.8.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectNeigh) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_redirect_neigh() (Linux 5.10.0 or newer)\")\n\t\t}\n\n\t\tif probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectPeer) != nil {\n\t\t\treturn errors.New(\"Require support for bpf_redirect_peer() (Linux 5.10.0 or newer)\")\n\t\t}\n\n\t\tif err := probes.HaveFibLookupSkipNeigh(); err != nil {\n\t\t\tif !errors.Is(err, probes.ErrNotSupported) {\n\t\t\t\treturn errors.New(\"Unable to determine if BPF_FIB_LOOKUP_SKIP_NEIGH is supported\")\n\t\t\t}\n\t\t\tlog.Info(\"BPF_FIB_LOOKUP_SKIP_NEIGH is not supported; it will not be used\")\n\t\t}\n\n\t\tif err := probes.HaveFibLookupSrc(); err != nil {","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/datapath/linux/requirements.go#L109-L145","documentation":"Returned by CheckRequirements when bpf_skb_change_head() is unavailable from a SCHED_CLS (tc) program. Cilium uses this helper to expand/adjust skb headroom when pushing headers (encapsulation, encapsulation-relative rewrites) in the datapath. While the helper is old, its availability from tc programs at the required capability is guaranteed since Linux 5.8.0, which is the floor Cilium enforces here.","triggerScenarios":"probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeHead) fails — kernel below the enforced 5.8.0 floor for this capability, or the verifier rejects the probe program (e.g., feature compiled out or incompatible backport).","commonSituations":"Older or custom kernels, stripped-down embedded/network-appliance kernels lacking full tc BPF helper support, heavily backported vendor kernels with divergent verifier behavior.","solutions":["Upgrade the host kernel to >= 5.8.0.","Verify full tc BPF support in custom kernels (CONFIG_NET_CLS_BPF, CONFIG_BPF_SYSCALL, helper availability).","Avoid stripped 'container-optimized' kernels that omit networking BPF helpers.","Use an older Cilium release if the kernel cannot be changed."],"exampleFix":"// before\n# custom 5.4 kernel without full tc helper set -> probe fails\n// after\n# run distro kernel >= 5.8 (e.g., 5.15) -> probe passes","handlingStrategy":"validation","validationCode":"if v := linux.GetKernelVersion(); v.KLT < 5 || (v.KLT == 5 && v.KRV < 8) {\n    return errors.New(\"kernel too old for Cilium: need >= 5.8 (skb_change_head from tc)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Avoid stripped/minimal custom kernels for Cilium nodes","Verify CONFIG_NET_CLS_BPF and full tc BPF helper support","Keep node kernels on maintained LTS branches","Check kernel support before enabling encapsulation features"],"tags":["ebpf","linux-kernel","skb","datapath"],"backgroundTag":"kernel-bpf-feature-unsupported","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}