CVE-2026-44778: Inspektor Gadget Denial of Service in USDT note parser

CVE-2026-44778 · Severity: medium · CVSS 4 · Published 2026-09-15

Inspektor Gadget is a tool used to monitor and debug Linux systems and Kubernetes clusters. A vulnerability in its USDT (User-Level Statically Defined Tracing) parser allows an unprivileged container to crash the main Inspektor Gadget process or cause it to run out of memory. This results in a denial of service for the monitoring infrastructure, though it does not directly expose customer data or allow for unauthorized code execution. This issue only affects users who have deployed custom gadgets using USDT probes; gadgets provided by the project itself are not affected.

Technologies: github.com/inspektor-gadget/inspektor-gadget (Go). Vendors: Go.

Quick answers

Is CVE-2026-44778 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44778 being exploited in the wild.
How severe is CVE-2026-44778?
Medium severity, with a CVSS score of 4, published 15 September 2026.
Which products and versions are affected?
github.com/inspektor-gadget/inspektor-gadget (Go) >= 0.28.0, < 0.53.1, SEMVER:introduced=0.28.0,fixed=0.53.1; Inspektor Gadget Project Inspektor Gadget >= 0.28.0, < 0.53.1.
Is there a fix for CVE-2026-44778?
Yes. github.com/inspektor-gadget/inspektor-gadget (Go): upgrade to 0.53.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44778 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-44778?
Check whether you run github.com/inspektor-gadget/inspektor-gadget (Go) or Inspektor Gadget Project Inspektor Gadget at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/inspektor-gadget/inspektor-gadget (Go): upgrade to 0.53.1 or later
    go get github.com/inspektor-gadget/inspektor-gadget@v0.53.1

Technical details

Inspektor Gadget's USDT note parser in `pkg/uprobetracer/usdt.go` is vulnerable to multiple denial-of-service vectors when processing malformed ELF binaries. First, an out-of-bounds slice access occurs in `getUsdtInfo()` when a `stapsdt` note has a small `DescSize`, leading to a process panic. Second, the parser lacks upper bounds on `NameSize` and `DescSize` fields, allowing an attacker to trigger an Out-of-Memory (OOM) kill by forcing allocations up to 4 GiB. Finally, the component lacks panic recovery when calling Go's `debug/elf` package, which is not hardened against adversarial inputs. Exploitation requires a user to deploy a custom gadget with a `SEC("usdt/...")` section targeting a library path controlled by an unprivileged attacker. The issue is fixed in version 0.53.1 by adding bounds checks, capping allocation sizes to 1 MiB, and implementing defer/recover blocks.

Affected products

  • Inspektor Gadget Project Inspektor Gadget >= 0.28.0, < 0.53.1

Identifiers

  • CVE-2026-44778
  • GHSA-7cfq-5mhv-jrp9
  • GO-2026-5214

Timeline

  • 2026-06-02: patched: Backport of security hardening fixes merged to release branch
  • 2026-06-16: disclosed: Advisory published by maintainers
  • 2026-06-22: advisory: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.