Inspektor Gadget is a collection of tools that leverages eBPF to collect data from Kubernetes clusters and Linux hosts. Prior to release 0.50.1, the tracing gadgets use a fixed 256 KB ring‑buffer to transport events from eBPF programs to user space. When the buffer is already full, the kernel ring‑buffer reservation fails and the gadget silently discards the event, resetting the lost‑event counter to zero. This behavior allows an attacker who can inject a large number of events—such as from a compromised container—to flood the ring‑buffer and cause the gadget to drop all subsequently generated events. The failure to surface loss causes operators to be unaware of the denial, effectively disabling observability (CWE‑223: Improper Error Handling, CWE‑770: Buffer Overflow).

The affected product is Inspektor Gadget (linuxfoundation:inspektor_gadget) running on Kubernetes clusters or Linux hosts that use a kernel version 5.8 or newer. All releases before 0.50.1 are vulnerable; no specific sub‑versions are enumerated in the advisory. The vulnerability originates in the buffer.h implementation that all supported gadgets use.

CVSS 4.8 indicates moderate severity, and the EPSS score of less than 1 % shows a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Successful exploitation requires an attacker to be able to generate a flood of eBPF events from within the cluster—typically via a compromised container or untrusted pod—providing local access to the host where the gadget runs. Attackers could then suppress monitoring and debugging output, potentially masking malicious activity.