CVE-2026-44778
Received Received - Intake

Memory Exhaustion in Inspektor Gadget USDT Parser

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC("usdt/...") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-44778
EUVD
EUVD-2026-78938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
inspektor_gadget inspektor_gadget to 0.53.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Inspektor Gadget (versions 0.28.0 to 0.53.1) involves a flaw in the USDT note parser that allows an unprivileged container to crash or exhaust memory of the privileged Inspektor Gadget process. It occurs when a custom gadget with a SEC("usdt/...") eBPF section attaches to a maliciously crafted ELF binary. The parser fails to validate input sizes, leading to out-of-bounds memory access or excessive memory allocation.

Detection Guidance

Detecting this vulnerability requires checking the Inspektor Gadget version and monitoring for crashes or memory exhaustion in the Inspektor Gadget process. Use commands like 'kubectl get pods -n <namespace>' to check pod status and 'kubectl logs <pod-name> -n <namespace>' to inspect logs for crashes. For system-level checks, use 'journalctl -u inspektor-gadget' to review daemon logs for errors related to ELF parsing or memory issues.

Impact Analysis

The impact is limited to denial of service (DoS) against the Inspektor Gadget monitoring infrastructure. It does not enable code execution or privilege escalation. An attacker could crash the privileged process or consume excessive system resources, potentially causing the daemon to become unresponsive or be terminated by the system's OOM killer.

Mitigation Strategies

Upgrade Inspektor Gadget to version 0.53.1 or later immediately. Disable any custom USDT gadgets until the upgrade is complete. Monitor the Inspektor Gadget process for crashes or high memory usage. If custom USDT gadgets are in use, review their configurations and restrict access to untrusted binaries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44778. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart