CVE-2026-31890
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, the gadget will silently drop events. The include/gadget/buffer.h file contains definitions for the Buffer API that gadgets can use to, among the other things, transfer data from eBPF programs to userspace. For hosts running a modern enough Linux kernel (>= 5.8), this transfer mechanism is based on ring-buffers. The size of the ring-buffer for the gadgets is hard-coded to 256KB. When a gadget_reserve_buf fails because of insufficient space, the gadget silently cleans up without producing an alert. The lost count reported by the eBPF operator, when using ring-buffers – the modern choice – is hardcoded to zero. The vulnerability can be used by a malicious event source (e.g. a compromised container) to cause a Denial Of Service, forcing the system to drop events coming from other containers (or the same container). This vulnerability is fixed in 0.50.1.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.8
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.14%
- CWE
- CWE-223, CWE-770
- Published
- 2026-03-12
- Last modified
- 2026-03-16
Affected products
- inspektor-gadget inspektor-gadget
Weakness type
Related vulnerabilities
- CVE-2026-49426 — Incorrect audit records for ptrace(2) syscall requests
- CVE-2025-35987 — Omission of security-relevant information for some Intel(R) Software Guard Extensions Data Center...
- CVE-2025-52926 — In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the...
- CVE-2024-52813 — matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity
- CVE-2023-31191 — Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
- CVE-2023-29156 — Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations
- CVE-2023-28360 — An omission of security-relevant information vulnerability exists in Brave desktop prior to version...
- CVE-2022-44646 — In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's...