Host Shield for Linuxhttps://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/Recent content on Host Shield for LinuxenFri, 17 Jul 2026 16:08:21 +0200 https://docs.sysdig.com/icons/sysdig-horizontal.pngHost Shield for Linuxhttps://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/Sysdig logoHost Shield for Linux - 14.7.1 July 9, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.7.1-july-9-2026Supported shield chart version: 1.46.3 Supported sysdig-deploy version: 1.115.2 Supported Falco Engine version: 1000.59.0 Defect Fixes Fixed an incompatibility with containerd v2.3.0 and later that could cause the Host Shield to stop unexpectedly. Fixed an issue that could cause the Host Shield to stop unexpectedly during NSS lookups.
  • Supported shield chart version: 1.46.3
  • Supported sysdig-deploy version: 1.115.2
  • Supported Falco Engine version: 1000.59.0

    • Defect Fixes

    • Fixed an incompatibility with containerd v2.3.0 and later that could cause the Host Shield to stop unexpectedly.
    • Fixed an issue that could cause the Host Shield to stop unexpectedly during NSS lookups.
    ]]>    14.7.1 July 9, 2026    Host Shield for Linux - 14.7.0 July 2, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.7.0-july-2-2026Addressed the following vulnerabilities:
  • Supported shield chart version: 1.46.0
  • Supported sysdig-deploy version: 1.115.0
  • Supported Falco Engine version: 1000.59.0

    • Enhancements

    Static Policy Scoping

    • Added static policy scoping. Policies scoped only on static labels (such as host.hostName, kubernetes.cluster.name, and agent.tag.*) are now evaluated at policy-load time instead of per event, reducing overhead on out-of-scope agents.

    Improved Host Posture Reliability in Restricted Networks

    • Improved Host Posture reliability in restricted network environments and enabled it to run where unencrypted inter-node traffic is prohibited, such as FedRAMP, by removing its dependency on pod-to-pod communication over port 12000. This enhancement is not yet available for on-premises installations.

    Kubernetes Metadata Enrichment for GitHub Runners and DinD

    • Improved Kubernetes metadata enrichment for events from GitHub Runners and Docker-in-Docker (DinD) workloads, so events inherit the parent workload’s Kubernetes metadata (cluster, namespace, workload, pod) when it isn’t directly available.

    Defect Fixes

    • Fixed an issue that could cause the agent to stop unexpectedly during NSS lookups.
    • Fixed an issue where Host Posture emitted spurious error-level log messages when retrieving cloud-environment metadata.
    • Fixed an issue causing container CPU usage to be over-reported in certain edge cases, including when the agent skipped metric samples.
    • Fixed excessive logging on cgroup v2 nodes when containers use file-backed transparent huge pages (THP).
    • Removed noisy statsite_forwarder warnings from the agent logs.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.7.0 July 2, 2026    Host Shield for Linux - 14.6.2 June 15, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.6.2-june-15-2026Addressed the following vulnerabilities:
  • Supported shield chart version: 1.43.1
  • Supported sysdig-deploy version: 1.113.3
  • Supported Falco Engine version: 1000.56.0

    • Defect Fixes

    • Fixed an error that could occur during NIS lookups starting from Host Shield 14.6.0.
    • Reduced log noise during transient container startup. The agent now logs a warning for a failed attempt to scope FIM policies to a container only after all retry attempts are exhausted, rather than on every failed attempt.
    • Fixed an issue where the kernel module failed to compile in containerized environments on Debian 13 and SLES 15.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.6.2 June 15, 2026    Host Shield for Linux - 14.6.1 June 3, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.6.1-june-3-2026Addressed the following vulnerabilities:
  • Supported shield chart version: 1.42.1
  • Supported sysdig-deploy version: 1.112.1
  • Supported Falco Engine version: 1000.56.0

    • Enhancements

    Configurable Container Metadata Lookup Retry Timeout

    • Exposed the container_fetch_retry_timeout_msec configuration parameter to control how long the agent keeps retrying a single container metadata lookup before giving up.

    Defect Fixes

    • Fixed an issue preventing Universal eBPF from working on Openshift 4.18 kernels

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.6.1 June 3, 2026    Host Shield for Linux - 14.6.0 May 19, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.6.0-may-19-2026Fixed missing fields and incorrect behavior on DNS events: resolved two bugs in DNS detection that could cause DNS events to be silently dropped or have fields missing, leading to policy rules not firing as expected and incomplete data in DNS-related alerts. Customers relying on DNS-based detection rules should see more consistent and complete DNS event data after this fix.
  • Supported shield chart version: 1.38.0
  • Supported sysdig-deploy version: 1.111.0
  • Supported Falco Engine version: 1000.55.0

    • Enhancements

    Enhanced Container Support Performance on Hosts with High Process Counts

    • Improved performance of container support, especially on machines with large numbers of running processes.

    Expanded Rootless Podman Container Detection

    • Extended container detection capabilities to dynamically surface rootless Podman containers.

    New Read only Filesystem Metrics

    • Introduced the sysdig_host_filesystem_readonly metric to indicate whether the host filesystem is mounted as read-only

    Improved Agent Performance During Posture Scanning

    • Reduced agent overhead by filtering syscall events from supervised subprocesses during posture scans and other intensive operations, resulting in lower CPU and memory usage.

    Added Kubernetes API request timeout configuration

    • Introduced k8s_api_request.socket_timeout_sec setting to allow control over socket timeout behavior for Kubernetes API requests.

    Least Privileged Mode Support for Host Shield

    Defect Fixes

    • Fixed missing fields and incorrect behavior on DNS events: resolved two bugs in DNS detection that could cause DNS events to be silently dropped or have fields missing, leading to policy rules not firing as expected and incomplete data in DNS-related alerts. Customers relying on DNS-based detection rules should see more consistent and complete DNS event data after this fix.

    • Fixed a bug which could cause host-scanner to hang indefinitely at startup when attempting to ping the Docker daemon, if Non-Kubernetes Containers scanning is enabled.

    • Fixed a bug causing containers to report memory usage exceeding their configured limits.

    • Addressed an issue where erroneous socket events could cause file descriptor tables to grow indefinitely, leading to potential unbounded memory consumption.

    • Fixed probe build failures on Fedora 42 and 43 distributions.

    • Resolved an occasional crash occurring when the system was running with observations enabled.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.6.0 May 19, 2026    Host Shield for Linux - 14.5.2 April 22, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.5.2-april-22-2026Addressed the following vulnerabilities:
  • Supported shield chart version: 1.34.6
  • Supported sysdig-deploy version: 1.109.7
  • Supported Falco Engine version: 1000.55.0

    • Defect Fixes

    • Fixed a performance issue in container support on machines with large numbers of running processes.
    • Fixed a bug that caused a container to report more memory than its configured limit.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.5.2 April 22, 2026    Host Shield for Linux - 14.5.1 April 15, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.5.1-april-15-2026Supported shield chart version: 2.7.2 Supported sysdig-deploy version: 1.109.6 Supported Falco Engine version: 1000.55.0 Enhancements Reduced File Descriptor Path Logging Verbosity Reduced log verbosity when resolving file descriptor paths. Defect Fixes Erroneous socket events caused file descriptor tables to grow, potentially leading to unbounded memory usage. Fixed an issue in Host Posture in which Linux host benchmark checks produced duplicate sysctl values, causing incorrect false-positive posture results. Fixed an issue in which Host Posture sent requests incompatible with on-premises installations earlier than version 7.7.0, preventing scans from being scheduled. Fixed an issue in which Host Posture sent duplicated results for the same host, preventing host posture evaluation from completing. Fixed an issue causing the agent to stop unexpectedly when running with observations enabled. Fixed an issue where the legacy_ebpf driver would not load on Oracle Linux version 8. Vulnerability Fixes CVE-2026-30922 CVE-2026-32280 CVE-2026-32283 CVE-2026-32288 CVE-2026-4519 CVE-2025-11468 CVE-2025-12781 CVE-2025-13837 CVE-2025-15282 CVE-2025-4516 CVE-2025-6069 CVE-2026-0672 CVE-2026-0865 CVE-2026-25645 CVE-2026-32282 CVE-2026-32289 CVE-2026-34073 CVE-2026-3644 CVE-2026-4224 CVE-2025-6075 CVE-2026-2297 CVE-2026-32281 CVE-2026-33810 CVE-2026-3479
  • Supported shield chart version: 2.7.2
  • Supported sysdig-deploy version: 1.109.6
  • Supported Falco Engine version: 1000.55.0

    • Enhancements

    Reduced File Descriptor Path Logging Verbosity

    • Reduced log verbosity when resolving file descriptor paths.

    Defect Fixes

    • Erroneous socket events caused file descriptor tables to grow, potentially leading to unbounded memory usage.
    • Fixed an issue in Host Posture in which Linux host benchmark checks produced duplicate sysctl values, causing incorrect false-positive posture results.
    • Fixed an issue in which Host Posture sent requests incompatible with on-premises installations earlier than version 7.7.0, preventing scans from being scheduled.
    • Fixed an issue in which Host Posture sent duplicated results for the same host, preventing host posture evaluation from completing.
    • Fixed an issue causing the agent to stop unexpectedly when running with observations enabled.
    • Fixed an issue where the legacy_ebpf driver would not load on Oracle Linux version 8.

    Vulnerability Fixes

    ]]>    14.5.1 April 15, 2026    Host Shield for Linux - 14.5.0 March 31, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.5.0-march-31-2026Addressed the following vulnerabilities:
  • Supported shield chart version: 1.33.0
  • Supported sysdig-deploy version: 1.108.0
  • Supported Falco Engine version: 1000.55.0

    • Enhancements

    Local Scanning for Kubernetes Container Workloads

    • Sysdig now supports local scanning of vulnerabilities for Kubernetes container workloads by using Host Shield image scanning on each node. This improves coverage for more complex environments, without relying solely on registry or agentless scanning paths. For more information, see Local Scanning.

    Reduced Agent Log Noise

    • Downgraded a recurring warning message in agent logs to Debug level. The message had no impact on functionality and required no action.

    Reduced Log Noise for Unresolvable Thread Entries

    • Reduced the severity of a log message that could appear frequently in agent logs and cause unnecessary concern and log rotation. The message, which indicated a thread without a resolvable main process, required no action and has been moved to Debug level to avoid surfacing as a warning during normal operations.

    Improved Handling of Delayed Container Events

    • Improved processing of delayed container events to ensure they are handled correctly when they arrive after their expected time.

    Defect Fixes

    • Fixed Prometheus exporter logging to prevent INFO-level messages from being reported as errors.
    • Fixed a bug where the baseliner does not respect the pause time after being stopped.
    • Resolved an issue where the kmod driver could exit unexpectedly under high load on large machines (48+ cores).
    • Fixed a pipe descriptor leak on shield restart when you enable Host Scanner or Rapid Response.
    • Fixed a segmentation fault and subsequent agent restart that was triggered when initiating a capture with a filter containing a plugin field.
    • Updated tests to include an additional subprocess required by the shield.
    • Fixed a race condition during Secure Policies reload that could cause the Host Shield to stop unexpectedly.
    • Resolved a bug causing backend exceptions and agent disconnections due to invalid protobuf payloads.
    • Fixed an issue where the container_image_tag metric label displayed an incorrect value when the container image reference included a registry port.
    • Fixed an issue where installing Host Shield using system packages failed on SUSE Linux Enterprise Server (SLES) 16 and Red Hat Enterprise Linux (RHEL) 10.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.5.0 March 31, 2026    Host Shield for Linux - 14.4.1 March 12, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.4.1-march-12-2026Improved processing of delayed container events to ensure they are handled correctly when they arrive after their expected time.
  • Supported sysdig-deploy version: 1.106.1
  • Supported Falco Engine version: 1000.52
  • Supported shield chart version: 1.30.2

    • Enhancements

    Improved Handling of Delayed Container Events

    Improved processing of delayed container events to ensure they are handled correctly when they arrive after their expected time.

    Defect Fixes

    • Fixed an issue in Host Scanner Vulnerability Management where packages could fail to be detected on: Amazon Linux, EulerOS, Talos, and minimal or hardened Alpine variants.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.4.1 March 12, 2026    Host Shield for Linux - 14.4.0 February 17, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.4.0-february-17-2026Starting from this release, Amazon Kinesis is available as target integration in Agent Local Forwarding, supporting both Amazon Kinesis Firehose and Amazon Kinesis Data Streams as configurable targets. For more information, see:
  • Supported sysdig-deploy version: 1.103.0
  • Supported Falco Engine version: 1000.52
  • Supported shield chart version: 1.28.0

    • Enhancements

    Sysdig Host Shield Key Stored in Memory

    • Host Shield can now load the access key from the SYSDIG_HOST_SHIELD_SYSDIG_ENDPOINT__ACCESS_KEY operating system environment variable. The access key will be stored in memory only and will not be written to disk.

    Reduced Collector Connection Log Verbosity

    • Reduced error log verbosity when retrying connections to the Sysdig collector.

    Improved Docker Audits with Mirantis Container Runtime (MCR)

    • Enhanced Docker audits to skip evaluation when Mirantis Container Runtime (MCR) is detected.

    Amazon Kinesis in Agent Local Forwarding

    Starting from this release, Amazon Kinesis is available as target integration in Agent Local Forwarding, supporting both Amazon Kinesis Firehose and Amazon Kinesis Data Streams as configurable targets. For more information, see:

    Defect Fixes

    • Fixed an issue where a malformed message shared may lead to backend disconnections.
    • Fixed metadata retrieval for IBM standalone virtual server instances.
    • Fixed an issue affecting the detection of incorrect container memory limits.
    • Fixed a minor memory usage issue in StatsD connection handling.
    • Fixed exceptions that occurred when the set of block devices present during aggregation changed.
    • Added support for Kubernetes version 1.29 to 1.32, including updated compliance audit coverage.
    • Fixed an issue that could cause Host Shield to run unnecessary Vulnerability Management scans after restarts.
    • Fixed a pipe descriptor leak on Shield restart when Host Scanner or Rapid Response is enabled.
    • Fixed the skip_events_by_process configuration to skip child processes spawned both before and after the Shield starts. This affects Host Shield version 14.3.x.
    • Improved Shield support bundle generation.
      • Support bundles are now created in the /tmp/ directory.
      • Added a compression fallback chain (bzip2 → gzip → uncompressed tar) to ensure bundle collection succeeds when preferred compression tools are unavailable.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    Known Issues

    • FIM detection relies on BPF_LINK_CREATE, which is not available on kernel versions earlier than 5.7 or libbpf versions earlier than 0.0.8. When this capability is unavailable, FIM detection will fail to initialize.

    Sysdig plans to fix this in an upcoming release.

    Workaround

    Upgrade the host kernel to version 5.7 or later, upgrade libbpf to version 0.0.8 or later, or temporarily disable the FIM feature before upgrading Shield.

    ]]>    14.4.0 February 17, 2026    Host Shield for Linux - 14.3.2 January 15, 2026https://docs.sysdig.com/en/release-notes/linux-host-shield-release-notes/#14.3.2-january-15-2026Addressed the following vulnerabilities:
  • Supported sysdig-deploy version: 1.99.7
  • Supported Falco Engine version: 1000.51
  • Supported shield chart version: 1.25.4

    • Defect Fixes

    • Fixed metadata retrieval in IBM standalone virtual server instances.
    • Fixed a bug that could cause the Shield to enter an infinite loop when handling the recvmsg and recvmmsg syscalls.

    Vulnerability Fixes

    Addressed the following vulnerabilities:

    ]]>    14.3.2 January 15, 2026