Answer in brief
CVE-2026-44778 records a Low severity (CVSS 2.9) vulnerability in Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF. The current sources do not mark it as known exploited. The current feed maps inspektor-gadget/inspektor-gadget (generic), github.com/inspektor-gadget/inspektor-gadget (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 2.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps inspektor-gadget/inspektor-gadget (generic), github.com/inspektor-gadget/inspektor-gadget (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| inspektor-gadget/inspektor-gadgetgeneric | >=0.28.0 <0.53.1 | 0.53.1 |
| github.com/inspektor-gadget/inspektor-gadgetgo | >=0.28.0,<0.53.1 | 0.53.1 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 22, 2026
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the privileged Inspektor Gadget process when a custom gadget containing a SEC("usdt/...") eBPF section attaches to a crafted ELF binary. The getUsdtInfo() function reads the .note.stapsdt section without validating that DescSize is large enough for three address fields, allowing an out-of-bounds slice operation to panic, and it uses untrusted NameSize and DescSize values for allocations that can consume gigabytes of memory. The parser also invokes debug/elf without panic recovery, allowing other malformed ELF structures to terminate the process. No gadget shipped by Inspektor Gadget uses USDT probes, so only deployments using custom USDT gadgets are affected, and the demonstrated impact is denial of service rather than code execution or privilege escalation. This issue is fixed in version 0.53.1.
Quoted source text, attributed separately from HOL analysis.