Require support for bpf_skb_change_head() (Linux 5.8.0 or ne

Error message

Require support for bpf_skb_change_head() (Linux 5.8.0 or newer)

What it means

Returned by CheckRequirements when bpf_skb_change_head() is unavailable from a SCHED_CLS (tc) program. Cilium uses this helper to expand/adjust skb headroom when pushing headers (encapsulation, encapsulation-relative rewrites) in the datapath. While the helper is old, its availability from tc programs at the required capability is guaranteed since Linux 5.8.0, which is the floor Cilium enforces here.

Source

Thrown at pkg/datapath/linux/requirements.go:127

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkAssign) != nil {
			return errors.New("Require support for bpf_sk_assign() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnGetCgroupClassid) != nil {
			return errors.New("Require support for bpf_get_cgroup_classid() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.CGroupSockAddr, asm.FnPerfEventOutput) != nil {
			return errors.New("Require support for bpf_perf_event_output() (Linux 5.7.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnCsumLevel) != nil {
			return errors.New("Require support for bpf_csum_level() (Linux 5.8.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeHead) != nil {
			return errors.New("Require support for bpf_skb_change_head() (Linux 5.8.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectNeigh) != nil {
			return errors.New("Require support for bpf_redirect_neigh() (Linux 5.10.0 or newer)")
		}

		if probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnRedirectPeer) != nil {
			return errors.New("Require support for bpf_redirect_peer() (Linux 5.10.0 or newer)")
		}

		if err := probes.HaveFibLookupSkipNeigh(); err != nil {
			if !errors.Is(err, probes.ErrNotSupported) {
				return errors.New("Unable to determine if BPF_FIB_LOOKUP_SKIP_NEIGH is supported")
			}
			log.Info("BPF_FIB_LOOKUP_SKIP_NEIGH is not supported; it will not be used")
		}

		if err := probes.HaveFibLookupSrc(); err != nil {

View on GitHub (pinned to ac7b90affa)

Solutions

Upgrade the host kernel to >= 5.8.0.
Verify full tc BPF support in custom kernels (CONFIG_NET_CLS_BPF, CONFIG_BPF_SYSCALL, helper availability).
Avoid stripped 'container-optimized' kernels that omit networking BPF helpers.
Use an older Cilium release if the kernel cannot be changed.

Example fix

// before
# custom 5.4 kernel without full tc helper set -> probe fails
// after
# run distro kernel >= 5.8 (e.g., 5.15) -> probe passes

Defensive patterns

Strategy: validation

Validate before calling

if v := linux.GetKernelVersion(); v.KLT < 5 || (v.KLT == 5 && v.KRV < 8) {
    return errors.New("kernel too old for Cilium: need >= 5.8 (skb_change_head from tc)")
}

Prevention

Avoid stripped/minimal custom kernels for Cilium nodes
Verify CONFIG_NET_CLS_BPF and full tc BPF helper support
Keep node kernels on maintained LTS branches
Check kernel support before enabling encapsulation features

When it happens

Trigger: probes.HaveProgramHelper(log, ebpf.SchedCLS, asm.FnSkbChangeHead) fails — kernel below the enforced 5.8.0 floor for this capability, or the verifier rejects the probe program (e.g., feature compiled out or incompatible backport).

Common situations: Older or custom kernels, stripped-down embedded/network-appliance kernels lacking full tc BPF helper support, heavily backported vendor kernels with divergent verifier behavior.

Related errors

AI-assisted analysis of cilium/cilium@ac7b90affa (2026-08-31). Data as JSON: /api/errors/b5452a511a9cddf8. Report an issue: GitHub.