CVE-2026-48496: OpenTelemetry eBPF Profiler DOS Vulnerability

CVE-2026-48496 Overview

CVE-2026-48496 affects the OpenTelemetry eBPF Profiler, a production-scale agent used to profile applications across multiple programming languages. An unprivileged local process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely. The blocked read prevents further Executable and Linkable Format (ELF) analysis, producing a denial of service against the profiling agent. The issue affects versions starting at 0.0.202527 and prior to 0.0.202622. The vulnerability is tracked under CWE-770: Allocation of Resources Without Limits or Throttling and is fixed in release 0.0.202622.

Critical Impact
A local unprivileged process can indefinitely stall the OpenTelemetry eBPF Profiler by exposing a FIFO or other nonregular file as a memory mapping, halting all subsequent ELF analysis.

Affected Products

OpenTelemetry eBPF Profiler versions 0.0.202527 through 0.0.202621
OpenTelemetry eBPF Profiler release 0.0.202622 (patched)
Deployments consuming the profiler as a library through libpf/pfelf

Discovery Timeline

2026-09-11 - CVE-2026-48496 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-48496

Vulnerability Analysis

The OpenTelemetry eBPF Profiler inspects process memory mappings to locate ELF binaries for symbolization. When the profiler encounters a mapping backed by a file, it opens the file and reads its contents to perform ELF parsing. The code path does not verify that the target path refers to a regular file before opening it with default blocking semantics.

An unprivileged process on the same host can arrange for one of its mappings to reference a nonregular file, such as a FIFO (named pipe). When the profiler opens the FIFO, the open and subsequent read calls block until a writer supplies data. Because the profiler performs analysis serially, this single blocked descriptor stalls the entire ELF analysis pipeline and results in a denial of service for the agent.

Root Cause

The root cause is missing validation of the file type prior to opening mapping-backed paths in libpf/pfelf/file.go. Because the profiler did not restrict inputs to regular files or apply non-blocking flags, any local process could steer the agent into a blocking open/read on a controlled FIFO. This matches CWE-770: the profiler allocates a blocking file-handle resource without any bound on how long that operation can wait.

Attack Vector

Exploitation requires local access but no privileges and no user interaction. An unprivileged attacker maps a FIFO (or comparable nonregular file) into their own process address space and waits for the profiler to enumerate mappings. When the profiler opens the FIFO for ELF inspection, the read blocks indefinitely, freezing further analysis for other processes on the host.

// Patch from libpf/pfelf/file.go introducing safe file handoff
// Source: https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4
	return ff, nil
}

// OpenFile prepares an already-open file for use as an ELF binary.
// The file will be closed when the returned File is closed.
func OpenFile(f *os.File) (*File, error) {
	ff, err := newFile(f, f, 0, false)
	if err != nil {
		_ = f.Close()
		return nil, err
	}
	return ff, nil
}

// Close closes the File.
func (f *File) Close() (err error) {
	if f.mmapReader != nil {

The patch introduces an OpenFile entry point that accepts an already-open *os.File. Callers can now open the mapping path with flags such as O_NONBLOCK or after validating the file type, then hand the descriptor to pfelf for ELF parsing without exposing the library itself to a blocking open.

Detection Methods for CVE-2026-48496

Indicators of Compromise

A profiler process stuck in an uninterruptible or blocking read on a file descriptor that resolves to a FIFO, socket, or character device.
Long-lived open handles from the profiler pointing to paths under user-writable directories such as /tmp, /dev/shm, or user home directories.
Sudden cessation of ELF symbolization events from an otherwise healthy profiler agent.

Detection Strategies

Inspect /proc/<profiler_pid>/fd and correlate with /proc/<profiler_pid>/stack to identify blocked file operations on nonregular files.
Monitor for unprivileged processes creating FIFOs (mkfifo) and then mapping them via mmap prior to profiler enumeration.
Alert on profiler agents whose ELF analysis throughput drops to zero while the process remains alive and responsive to signals.

Monitoring Recommendations

Emit health telemetry from the profiler that surfaces per-mapping open latency; treat outliers as suspect.
Track the running version of opentelemetry-ebpf-profiler across the fleet and flag any host on a version between 0.0.202527 and 0.0.202621.
Collect audit logs for mkfifo, mknod, and unusual mmap events from non-service accounts on hosts running the profiler.

How to Mitigate CVE-2026-48496

Immediate Actions Required

Upgrade all OpenTelemetry eBPF Profiler deployments to version 0.0.202622 or later, as published in GitHub Release v0.0.202622.
Inventory hosts running affected versions (0.0.202527 through 0.0.202621) and prioritize multi-tenant systems where local unprivileged users are present.
Restart profiler agents after upgrade to release any descriptors already blocked on FIFOs.

Patch Information

The fix is delivered in commit 234b685c and released in 0.0.202622. The patch introduces an OpenFile API in libpf/pfelf/file.go that accepts a pre-opened *os.File, allowing callers to validate the file type or apply non-blocking open flags before handing the descriptor to the ELF parser. See the GitHub Security Advisory GHSA-f2r5-5m7w-p5cx for the coordinated disclosure details.

Workarounds

No official workarounds are available; upgrading to 0.0.202622 is required per the vendor advisory.
As a defense-in-depth measure, restrict which local accounts can execute code on hosts running the profiler to reduce the exposure surface.

bash

# Verify installed profiler version and upgrade path
otel-profiling-agent --version

# Example upgrade using the tagged release artifact
curl -LO https://github.com/open-telemetry/opentelemetry-ebpf-profiler/releases/download/v0.0.202622/otel-profiling-agent
chmod +x otel-profiling-agent
sudo systemctl restart otel-profiling-agent