Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53941— Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Quick assessment

Affected
inspektor-gadget inspektor-gadget
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Inspektor Gadget 是一套基于 eBPF 的工具集和框架，用于在 Kubernetes 集群和 Linux 主机上进行数据收集和系统检查。 在 0.27.0 至 0.53.1 版本中，uprobe 库解析器允许非特权容器通过提供一个精心构造的 文件，在 uprobe 组件处于活动状态时，消耗过量 CPU 并阻塞其他容器的启动。 具体而言， 中的解析器过度信任 字段，导致进行大量迭代；使用 算术计算 时发生溢出；并在 中反复调用 函数。由于该函数内部对不可变字符串进行逐字节拼接，从而产生二次方级的时间复

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53941

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
Source: CVE Program / CVE List V5
Vulnerability Description
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.27.0 until 0.53.1, the uprobe library resolver can allow an unprivileged container to consume excessive CPU and block other containers from starting by supplying a crafted /etc/ld.so.cache file while an uprobe-based gadget is active. The parser in pkg/uprobetracer/ldcache_parser.go trusts EntryCount enough to perform excessive iteration, computes cache1Len with overflowing uint32 arithmetic, and repeatedly calls readStringFromBytes in pkg/uprobetracer/bytes.go, where byte-by-byte immutable string concatenation produces quadratic work. While this processing occurs, pkg/container-hook holds the fanotify container-start pause, allowing a crafted cache to delay startup for roughly a minute, prevent Docker from starting other containers, and degrade monitoring. Processing caches from already-running containers can still consume CPU but does not hold the new-container startup pause, and the advisory establishes no confidentiality or integrity impact. This issue is fixed in version 0.53.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
inspektor-gadget inspektor-gadget >= 0.27.0, < 0.53.1 -

II. Public POCs for CVE-2026-53941

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53941

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53941 (2)

Vendor Advisories for CVE-2026-53941 (1)

Vendor Pages for CVE-2026-53941 (1)

IV. Related Vulnerabilities

Same product: inspektor-gadget
Same vendor: inspektor-gadget
Same weakness: CWE-770

V. Comments for CVE-2026-53941

No comments yet

Leave a comment