Researchers at Virginia Tech and the University of British Columbia will develop open source approaches to improve eBPF diagnostics and secure virtual machine observability
Summary
- The eBPF Foundation has awarded $100,000 in grants to researchers at Virginia Tech and the University of British Columbia.
- Two $50,000 grants will support research into eBPF developer diagnostics and secure virtual machine observability, addressing challenges in usability and security.
- Grant recipients will open source project deliverables, making the resulting research available to the broader eBPF community.
SAN FRANCISCO, Sept. 3, 2026 — The eBPF Foundation, which advances eBPF’s upstream development and promotes its secure adoption across platforms, today announced the recipients of its 2026 Academic Research Grants, awarding a total of $100,000 to projects at Virginia Tech and the University of British Columbia. The program received 29 proposals from 23 universities, reflecting growing academic interest in eBPF and research addressing important development and infrastructure challenges.
The two selected projects focus on making it easier for developers to diagnose and resolve verifier errors and enabling cloud operators to securely observe virtual machines from outside guest environments. Each research team will receive an unrestricted $50,000 grant and will open source its project deliverables so the work can be used and built upon by the broader eBPF community.
“eBPF has evolved into a foundational building block for modern infrastructure software,” said Bill Mulligan, governing board chair at the eBPF Foundation. “As adoption grows, advancing security and developer efficiency is critical. By funding research to test the boundaries of what is possible with eBPF, our academic grant program aligns directly with the eBPF Foundation’s upstream-focused mission. In addition, by requiring open source contributions and kernel patches, we ensure that these academic breakthroughs translate into long term safety and performance gains for the entire Linux ecosystem.”
Dan Williams of Virginia Tech was awarded a grant to improve the experience of diagnosing eBPF verifier errors. The Linux kernel’s eBPF verifier plays an essential role in ensuring programs can run safely, but its rejection logs can be difficult for developers to interpret. Williams’ project will create automated diagnostic workflows designed to translate complex verifier errors into clearer, actionable guidance, helping developers identify problems more quickly and reducing the learning curve for writing eBPF programs.
“Fixing a rejected eBPF program requires considerable manual work and knowledge of the verifier’s rules, because the verifier log provides debug information at the bytecode level rather than the source level, and only partially expresses the unsatisfied safety requirement that caused the rejection,” said Dan Williams, assistant professor of computer science at Virginia Tech. “Our insight is that, from the verifier log alone, we can reconstruct sufficient states to identify both the cause of the rejection and the source lines that should be changed. The goal of this project is to build a userspace command-line tool that produces a source-level, actionable diagnostic, helping developers to diagnose the rejection and propose a fix with less effort.”
Thomas Pasquier of the University of British Columbia was awarded a grant to explore new approaches to securely observing virtual machines from outside the guest environment. The research will examine how eBPF can provide cloud operators with deeper visibility into running workloads while maintaining separation between monitoring infrastructure and tenant systems. Building on RemoteBPF and GoodKit, the work aims to strengthen approaches to security analysis and system monitoring in multi-tenant cloud environments.
“We are developing RemoteBPF, a new approach for securely observing and analyzing virtual machines in cloud environments,” said Thomas Pasquier, assistant professor at the University of British Columbia. “The project combines eBPF’s fine-grained monitoring capabilities with GoodKit’s isolated virtual-machine introspection architecture, keeping most monitoring logic outside the observed system. A working prototype already demonstrates remote execution and management of eBPF programs across virtual machines.”
To learn more about the eBPF Foundation’s Academic Research Grant Program, visit https://ebpf.foundation/funding-opportunities/research-fund/.
About the eBPF Foundation
The eBPF Foundation was created to advance eBPF by guiding upstream development, promoting its benefits, and enhancing its security and reliability. The Foundation aims to nurture the open source eBPF ecosystem and serve as a focal point for collaboration. For more information, please visit https://ebpf.foundation/.
Media Contact
The Linux Foundation