Require support for bpf_csum_level() (Linux 5.8.0 or newer)

Error message

Require support for bpf_csum_level() (Linux 5.8.0 or newer)

What it means

Returned by CheckRequirements when bpf_csum_level() is unavailable from a SCHED_CLS (tc) program. Cilium uses this helper to manage the checksum level when re-encapsulating/decapsulating packets (e.g., VXLAN, Geneve), which is required for correct offloaded checksums. The helper exists since Linux 5.8.0.

Source

Thrown at pkg/datapath/linux/requirements.go:123

		if probes.HaveProgramHelper(log, ebpf.CGroupSock, asm.FnGetNetnsCookie) != nil ||
			probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnGetNetnsCookie) != nil {
			return errors.New("Require support for bpf_get_netns_cookie() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkAssign) != nil {
			return errors.New("Require support for bpf_sk_assign() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnGetCgroupClassid) != nil {
			return errors.New("Require support for bpf_get_cgroup_classid() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnPerfEventOutput) != nil {
			return errors.New("Require support for bpf_perf_event_output() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnCsumLevel) != nil {
			return errors.New("Require support for bpf_csum_level() (Linux 5.8.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeHead) != nil {
			return errors.New("Require support for bpf_skb_change_head() (Linux 5.8.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectNeigh) != nil {
			return errors.New("Require support for bpf_redirect_neigh() (Linux 5.10.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectPeer) != nil {
			return errors.New("Require support for bpf_redirect_peer() (Linux 5.10.0 or newer)")
		}

		if err := probes.HaveFibLookupSkipNeigh(); err != nil {
			if !errors.Is(err, probes.ErrNotSupported) {
				return errors.New("Unable to determine if BPF_FIB_LOOKUP_SKIP_NEIGH is supported")
			}

View on GitHub (pinned to ac7b90affa)

Solutions

Upgrade the host kernel to 5.8.0 or newer (5.10+ LTS recommended).
If on a backported vendor kernel, confirm the helper is actually present (some distros backport features without raising uname).
Run a Cilium release matching your kernel's capability level if upgrade is not possible.

Example fix

// before
$ uname -r
5.7.0-0.bpo  # fails: Require support for bpf_csum_level()
// after
$ uname -r
5.10.0-x  # >= 5.8 -> probe passes

Defensive patterns

Strategy: validation

Validate before calling

if v := linux.GetKernelVersion(); v.KLT < 5 || (v.KLT == 5 && v.KRV < 8) {
    return errors.New("kernel too old for Cilium: need >= 5.8 (bpf_csum_level)")
}

Prevention

Use 5.10+ LTS kernels as the minimum node image
Re-validate kernel floor after every distro upgrade
Avoid mixing node pools with kernels below the Cilium requirement table
Run cilium's preflight kernel checks in CI

When it happens

Trigger: probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnCsumLevel) fails — kernel < 5.8.0 or verifier rejection of the tc probe program (feature compiled out).

Common situations: 5.7 or older kernels (e.g., Ubuntu 20.04's 5.4), vendor kernels without the helper backported, custom minimal kernels.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/0947af51e0761475. Report an issue: GitHub.