Denial of Service Vulnerability in Inspektor Gadget for Kubernetes and Linux Hosts

CVE-2026-44778

What is CVE-2026-44778?

Inspektor Gadget, a framework for data collection and system inspection in Kubernetes and Linux environments, is susceptible to a denial of service vulnerability. This issue arises in versions 0.28.0 through 0.53.1 due to a flaw in the USDT note parser that permits unprivileged containers to crash or exhaust the memory of the privileged Inspektor Gadget process. Specifically, the getUsdtInfo() function improperly processes the .note.stapsdt section without appropriate validation, leading to out-of-bounds errors. Moreover, it makes memory allocations based on untrusted values that can consume excessive memory. Although deployed custom USDT gadgets are affected, Inspektor Gadget itself does not provide any by default, meaning only custom configurations are vulnerable. This concern was addressed in version 0.53.1, restoring process stability and preventing potential service disruptions.

References