CVE-2026-44778: Inspektor Gadget USDT Parser DoS Vulnerability

CVE-2026-44778 Overview

CVE-2026-44778 is a denial-of-service vulnerability in Inspektor Gadget, an eBPF-based data collection and system inspection framework for Kubernetes clusters and Linux hosts. The flaw resides in the User Statically Defined Tracing (USDT) note parser at pkg/uprobetracer/usdt.go and affects versions from 0.28.0 up to but not including 0.53.1. An unprivileged container can crash or exhaust the memory of the privileged Inspektor Gadget process by loading a custom gadget with a SEC("usdt/...") eBPF section that attaches to a crafted Executable and Linkable Format (ELF) binary. The getUsdtInfo() function fails to validate note field sizes before performing slice operations and allocations. The issue is fixed in version 0.53.1.

Critical Impact
An unprivileged container can crash the privileged Inspektor Gadget process or exhaust host memory by triggering out-of-bounds panics and multi-gigabyte allocations during USDT note parsing.

Affected Products

Inspektor Gadget versions 0.28.0 through 0.53.0
Deployments using custom gadgets with SEC("usdt/...") eBPF sections
Kubernetes clusters and Linux hosts running vulnerable Inspektor Gadget builds

Discovery Timeline

2026-09-15 - CVE-2026-44778 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-44778

Vulnerability Analysis

The vulnerability is classified as Improper Input Validation [CWE-20] and manifests as a denial of service in the USDT note parser. Inspektor Gadget reads the .note.stapsdt section from ELF binaries to enumerate USDT probe locations. The getUsdtInfo() function trusts the NameSize and DescSize fields from the ELF note header without applying upper bounds. A crafted binary can declare arbitrarily large sizes, causing the parser to allocate gigabytes of memory in the privileged Inspektor Gadget process.

A second defect occurs when DescSize is smaller than expected. The parser slices the descriptor buffer to extract three address fields without confirming the buffer contains enough bytes, producing an out-of-bounds slice panic. The parser also invokes the Go standard library debug/elf package without any panic recovery, so any malformed ELF structure that triggers a panic inside debug/elf terminates the entire Inspektor Gadget process.

No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments running custom USDT gadgets are exposed. The demonstrated impact is denial of service. Code execution and privilege escalation were not demonstrated.

Root Cause

The root cause is missing size validation on attacker-controlled ELF note fields and absent panic recovery around calls into debug/elf. The parser treats untrusted binary metadata as authoritative for allocation sizes and slice bounds.

Attack Vector

An attacker in an unprivileged container supplies a custom gadget containing a SEC("usdt/...") eBPF section that references a crafted ELF binary. When the privileged Inspektor Gadget process parses the malicious .note.stapsdt section, it either panics on an out-of-bounds slice, allocates excessive memory, or terminates from an unrecovered debug/elf panic.

// Security patch in pkg/uprobetracer/usdt.go
// uprobetracer: Harden USDT note parsing against malicious ELF files
const (
	sdtNoteSectionName = ".note.stapsdt"
	sdtBaseSectionName = ".stapsdt.base"

	// maxNoteFieldSize limits the size of individual note name/desc fields to
	// prevent excessive memory allocation from malformed ELF files. There is no
	// standard upper bound for ELF note fields; 1 MiB is a generous arbitrary
	// cap — legitimate USDT notes are typically under 1 KB.
	maxNoteFieldSize = 1024 * 1024
)

type noteHeader struct {

Source: GitHub Commit aaffacc6

Detection Methods for CVE-2026-44778

Indicators of Compromise

Unexpected termination or crash loop of the Inspektor Gadget pod or daemon on nodes running custom gadgets
Sudden memory pressure or Out-Of-Memory (OOM) kills on nodes hosting the privileged Inspektor Gadget process
Custom gadget deployments referencing SEC("usdt/...") sections combined with untrusted target ELF binaries
Container workloads submitting ELF binaries with malformed .note.stapsdt sections

Detection Strategies

Audit deployed gadget artifacts for SEC("usdt/...") eBPF sections and inventory the ELF targets they attach to
Monitor Kubernetes events and kubelet logs for Inspektor Gadget pod restarts, OOMKilled statuses, and panic stack traces referencing getUsdtInfo or debug/elf
Correlate Inspektor Gadget process crashes with recent gadget installations or workload changes on the same node

Monitoring Recommendations

Alert on resident set size growth of the Inspektor Gadget process exceeding baseline thresholds
Track pod restart counts for the inspektor-gadget DaemonSet and page on repeated crashes
Log and review all custom gadget loads to detect USDT probe usage in multi-tenant clusters

How to Mitigate CVE-2026-44778

Immediate Actions Required

Upgrade Inspektor Gadget to version 0.53.1 or later on all Kubernetes nodes and Linux hosts
Inventory custom gadgets in use and disable any USDT-based gadgets until the upgrade is applied
Restrict which principals can load custom gadgets in shared clusters to trusted operators only

Patch Information

The fix is delivered in Inspektor Gadget v0.53.1. Commit aaffacc6 hardens USDT note parsing by capping note field sizes at maxNoteFieldSize (1 MiB) and validating DescSize before slicing. Commit 27263e50 introduces pkg/utils/safeelf, a panic-safe wrapper around debug/elf used by pkg/operators/ebpf/extrainfo.go and pkg/symbolizer/table.go. See GHSA-7cfq-5mhv-jrp9 and Pull Request #5547 for the full advisory.

Workarounds

Avoid loading custom gadgets that declare SEC("usdt/...") sections until patched
Prevent untrusted containers from providing ELF binaries that Inspektor Gadget will attach USDT probes to
Apply Kubernetes Role-Based Access Control (RBAC) policies that restrict gadget submission to trusted service accounts

bash

# Upgrade Inspektor Gadget to the patched release
kubectl gadget deploy --image=ghcr.io/inspektor-gadget/inspektor-gadget:v0.53.1

# Verify the running version matches the fixed release
kubectl gadget version