NEW YORK — What happened
On September 17, 2026, three major public cloud providers experienced simultaneous micro-outages affecting their API gateways and serverless control planes. The root cause was traced to an updated Linux kernel eBPF program deployed across edge routers designed to monitor network latency.
Why it matters
eBPF allows programs to run directly inside the Linux kernel without changing kernel source code. While praised for performance and observability, this incident demonstrates that kernel-space software still carries cascading risks across multi-tenant infrastructure when safety verifiers fail to catch memory leaks.
Deep dive
The issue stemmed from an unhandled map lookup failure in the eBPF probe under high packet rates. Instead of failing gracefully, the probe leaked a small amount of kernel memory on every failed lookup. Over 72 hours, worker nodes depleted their non-paged pool memory, causing kernel panics that disrupted API traffic routing.
Report check
Initial claims suggested a coordinated distributed denial-of-service (DDoS) attack. However, telemetry reports published by independent incident response teams confirmed no external malicious traffic occurred; the failure was purely internal software degradation.
Open questions
How will cloud providers sandbox low-level eBPF drivers in the future, and will open-source Linux kernel maintainers enforce stricter static analysis rules before eBPF bytecode execution?