BPF maps are shared data structures used by eBPF programs to store and exchange state. An eBPF program runs in the Linux kernel under tight limits, so it often needs a map to remember counters, cache lookups, pass data between hooks, or receive configuration from user space. Common map types include hash maps, arrays, and ring buffers.
In cyber security, BPF maps matter because they sit close to the kernel and can support both defense and abuse. Legitimate tools use them for tracing, networking, and observability. Offensive tooling may use maps to keep hidden state, coordinate multiple eBPF components, or move data without relying on obvious files and processes. Defenders watch for unusual map creation, updates, and pinned maps, especially when they are paired with suspicious eBPF loading activity.