CVE-2026-31890
Silent Event Drop Denial of Service in Inspektor Gadget Ring-Buffer
Publication date: 2026-03-12
Last updated on: 2026-04-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linuxfoundation | inspektor_gadget | to 0.50.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
| CWE-223 | The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-31890 is a Denial of Service (DoS) vulnerability in the inspektor-gadget project, which is a toolset for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The vulnerability occurs because the ring-buffer used to transfer event data from eBPF programs to userspace has a fixed size of 256 KB. When this buffer becomes full, either incidentally or due to malicious flooding, new events are silently dropped without any alert or logging.
The userspace component that reads events from the ring-buffer does not report any lost events because the lost event count is hardcoded to zero. This means that if the buffer is full, legitimate events can be lost without detection. An attacker who can generate arbitrary events (for example, from a compromised container) can flood the buffer, causing a Denial of Service by preventing other events from being recorded.
This vulnerability was fixed in inspektor-gadget version 0.50.1.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can impact you by causing a Denial of Service in the event tracing system of inspektor-gadget. If an attacker or a malfunctioning component floods the ring-buffer with events, legitimate events from other containers or processes will be silently dropped without any notification.'}, {'type': 'paragraph', 'content': "As a result, important security or system monitoring events may not be recorded or traced, potentially allowing malicious activity to go undetected. This can reduce the effectiveness of security monitoring and incident response mechanisms that rely on inspektor-gadget's event tracing."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for silent event drops in the inspektor-gadget event tracing system. Since the ring-buffer size is fixed at 256 KB and events are silently dropped when the buffer is full, one way to detect the issue is to observe if expected events are missing or not being traced.
A proof-of-concept involves running a flooding program that repeatedly opens and closes a file to fill the ring-buffer, causing subsequent monitored events (such as accesses to sensitive files like /etc/shadow) to be silently dropped.
Suggested commands to detect this behavior could include:
- Run a program that generates a high volume of events, for example, repeatedly opening and closing a file in a loop to flood the ring-buffer.
- Monitor inspektor-gadget logs or output for missing expected events, such as file access events to critical files.
- Use standard Linux tools to observe system calls or file accesses, for example, using `strace` on processes or `auditctl` to monitor file access, and compare with inspektor-gadget event outputs to detect discrepancies.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade inspektor-gadget to version 0.50.1 or later, where this vulnerability is fixed.
Since the vulnerability arises from a hardcoded ring-buffer size and silent event drops, upgrading ensures that the buffer handling is corrected and lost event counts are properly reported.
Until the upgrade is applied, consider limiting the ability of untrusted containers or processes to generate excessive events that could flood the ring-buffer, to reduce the risk of Denial of Service.