eBPF Foundation backs US academic research projects

The eBPF Foundation has awarded USD $100,000 in academic research grants to Virginia Tech and the University of British Columbia. The funding was split between two projects selected from 29 proposals submitted by 23 universities.

Each team will receive an unrestricted USD $50,000 grant and has committed to open source the resulting work, including any kernel patches. The projects focus on developer diagnostics for eBPF programs and the secure observation of virtual machines in cloud environments.

eBPF is used in Linux-based systems for networking, security, and observability, but some tooling remains difficult to use. The volume of submissions, the foundation noted, reflects growing academic interest in software infrastructure and systems security research.

Selected projects

At Virginia Tech, Dan Williams will work on a command-line tool to help developers interpret eBPF verifier rejection logs. The Linux kernel verifier is designed to stop unsafe programs from running, but its output can be difficult to understand because it is presented at the bytecode level rather than the source level.

The proposed tool would reconstruct enough information from verifier logs to identify the cause of a rejection and point developers to the source lines that need to change. The goal is to reduce the manual effort required to fix rejected programs and lower the barrier for developers writing eBPF code.

"Fixing a rejected eBPF program requires considerable manual work and knowledge of the verifier's rules, because the verifier log provides debug information at the bytecode level rather than the source level, and only partially expresses the unsatisfied safety requirement that caused the rejection," said Dan Williams, Assistant Professor of Computer Science at Virginia Tech.

"Our insight is that, from the verifier log alone, we can reconstruct sufficient states to identify both the cause of the rejection and the source lines that should be changed. The goal of this project is to build a userspace command-line tool that produces a source-level, actionable diagnostic, helping developers diagnose the rejection and propose a fix with less effort," Williams said.

At the University of British Columbia, Thomas Pasquier will examine ways to observe virtual machines from outside the guest environment. The work builds on RemoteBPF and GoodKit, which are intended to let cloud operators inspect workloads while keeping monitoring systems separate from tenant environments.

The project addresses a long-running challenge in multi-tenant cloud infrastructure: gaining visibility into running systems without weakening isolation boundaries. The foundation said a working prototype already demonstrates remote execution and management of eBPF programs across virtual machines.

"We are developing RemoteBPF, a new approach for securely observing and analyzing virtual machines in cloud environments," said Thomas Pasquier, Assistant Professor at the University of British Columbia.

"The project combines eBPF's fine-grained monitoring capabilities with GoodKit's isolated virtual-machine introspection architecture, keeping most monitoring logic outside the observed system. A working prototype already demonstrates remote execution and management of eBPF programs across virtual machines," Pasquier said.

Foundation view

Bill Mulligan, Governing Board Chair at the eBPF Foundation, said the grants are intended to support research that addresses both usability and security challenges as eBPF spreads across modern infrastructure software.

"eBPF has evolved into a foundational building block for modern infrastructure software," said Bill Mulligan, Governing Board Chair at the eBPF Foundation. "As adoption grows, advancing security and developer efficiency is critical. By funding research to test the boundaries of what is possible with eBPF, our academic grant program aligns directly with the eBPF Foundation's upstream-focused mission. In addition, by requiring open source contributions and kernel patches, we ensure that these academic breakthroughs translate into long-term safety and performance gains for the entire Linux ecosystem."

The awards also show how eBPF research is moving beyond kernel internals into broader questions of developer experience, cloud operations, and security architecture. One project focuses on making low-level verifier feedback easier to act on, while the other explores how operators can monitor systems from outside the machines being observed.

Together, the projects reflect a broader shift in infrastructure software, where engineering teams want stronger safeguards without adding friction for developers or reducing visibility for operators. By funding unrestricted research grants and requiring public release of deliverables, the foundation is linking academic work to software others can inspect and reuse.

The grant program's shortlist emerged from 29 proposals submitted by 23 universities, indicating a growing pipeline of university-led work on eBPF and Linux systems research.