Falco
0.44.1SecurityFalco 0.44.1 adds BPF iterator control and fixes multiple BPF-related issues via a libs bump. Minimal release focused on stability for deployments using kernel-level tracing.
enhancementControl BPF iterator behavior if you hit performance or compatibility issues
Falco 0.44.1 introduces a config option to disable BPF iterators. If you run Falco on kernels with problematic BPF iterator implementations or see high CPU usage tied to iterator overhead, test disabling them. Check your Falco logs and metrics after upgrading to confirm the fix resolves any BPF-related instability you were seeing in 0.44.0.
breakingUpdate libs and kernel driver together
This release bumps libs to 0.25.4 and driver to 10.2.0+driver. If you pin kernel driver versions separately from Falco, ensure you update both in the same maintenance window. Mismatched versions can cause syscall capture failures or silent data loss.
主な変更 (3)
- Add disabling option for BPF iterators in userspace Falco configuration
- Bump libs to 0.25.4 and driver to 10.2.0+driver to resolve BPF iterator bugs
- Support for both x86_64 and aarch64 packages across rpm, deb, and tgz formats