PT-2026-51442 · Unknown · Inspektor-Gadget

CVE-2026-44778

·

Published

2026-06-22

·

Updated

2026-07-30

CVSS v4.0

2.9

Low

VectorAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions Inspektor Gadget versions 0.28.0 and later
Description A malicious container can crash or destabilize the privileged Inspektor Gadget process when a gadget using USDT (User-level Statically Defined Tracing) probes is deployed. The issue exists in the USDT note parser within the getUsdtInfo() function in pkg/uprobetracer/usdt.go, which is triggered when a gadget with a SEC("usdt/...") section attaches to a target binary. An unprivileged process can place a crafted ELF binary at the expected library path to trigger two attack vectors: a panic caused by an out-of-bounds slice access when the DescSize is too small, or memory exhaustion (OOM kill) when NameSize or DescSize are excessively large, potentially allocating up to 4 GiB of memory.
This issue only affects users deploying custom USDT gadgets, as no gadgets shipped by the Inspektor Gadget project currently use USDT probes.
Recommendations Update Inspektor Gadget to a version that includes the following fixes in pkg/uprobetracer/usdt.go:
  • Implement a bounds check to ensure len(desc) is at least 3*wordSize before accessing address fields.
  • Cap NameSize and DescSize allocations to a maximum of 1 MiB.
  • Wrap the getUsdtInfo() function with a defer/recover block to handle panics from the debug/elf package. As a temporary mitigation, avoid deploying custom gadgets that use USDT probes.

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-44778
GHSA-7CFQ-5MHV-JRP9
GO-2026-5214
OPENSUSE-SU-2026:21483-1

Affected Products

Inspektor-Gadget