Question About Reporting libbpf Fuzzing Findings

Question About Reporting libbpf Fuzzing Findings

[0xStrawHat]

Hello BPF maintainers,

I've been conducting a fuzzing campaign against libbpf and have identified 7 potential issues so far: 4 that appear to have medium severity and 3 that appear to have low severity.

I'd like to report these findings responsibly and make sure they reach the appropriate maintainers.

Could you please advise me on the preferred process for submitting these reports? Should I send them directly to this mailing list, or is there a separate channel for security-related findings?

I'm happy to provide individual reports with reproducer inputs, crash logs, affected versions, and any additional details needed for triage.

Thank you for your time and for maintaining libbpf.

Best regards

Re: Question About Reporting libbpf Fuzzing Findings

[Alexei Starovoitov]

On Sun Oct 11, 2026 at 3:50 PM UTC, 0xStrawHat wrote:
> Hello BPF maintainers,
>
> I've been conducting a fuzzing campaign against libbpf and have identified 7 potential issues so far: 4 that appear to have medium severity and 3 that appear to have low severity.
>
> I'd like to report these findings responsibly and make sure they reach the appropriate maintainers.

Do NOT.
libbpf trusts its intput. We explained it countless times.