Code has bugs. News at 11.

eBPF has had multiple CVEs. E.g.: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3489 or maybe https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0500 (there are about 20 CVE entries for eBPF).