Junglewise Threat Intelligence

CVE-2026-44778: Inspektor Gadget Denial of Service in USDT note parser

CVE-2026-44778 · Severity: low · CVSS 2.9 · Published 2026-06-22

Executive brief

Inspektor Gadget is a tool used to monitor and debug Linux systems and Kubernetes clusters. A vulnerability in its USDT (User-Level Statically Defined Tracing) parser allows an unprivileged container to crash the main Inspektor Gadget process or cause it to run out of memory. This results in a denial of service for the monitoring infrastructure, though it does not directly expose customer data or allow for unauthorized code execution. This issue only affects users who have deployed custom gadgets using USDT probes; gadgets provided by the project itself are not affected.

Technical details

Inspektor Gadget's USDT note parser in `pkg/uprobetracer/usdt.go` is vulnerable to multiple denial-of-service vectors when processing malformed ELF binaries. First, an out-of-bounds slice access occurs in `getUsdtInfo()` when a `stapsdt` note has a small `DescSize`, leading to a process panic. Second, the parser lacks upper bounds on `NameSize` and `DescSize` fields, allowing an attacker to trigger an Out-of-Memory (OOM) kill by forcing allocations up to 4 GiB. Finally, the component lacks panic recovery when calling Go's `debug/elf` package, which is not hardened against adversarial inputs. Exploitation requires a user to deploy a custom gadget with a `SEC("usdt/...")` section targeting a library path controlled by an unprivileged attacker. The issue is fixed in version 0.53.1 by adding bounds checks, capping allocation sizes to 1 MiB, and implementing defer/recover blocks.

Affected products

  • Inspektor Gadget Project Inspektor Gadget >= 0.28.0, < 0.53.1

Timeline

  • 2026-06-02: patched: Backport of security hardening fixes merged to release branch
  • 2026-06-16: disclosed: Advisory published by maintainers
  • 2026-06-22: advisory: GitHub Advisory reviewed and updated

References

Related threats