An unprivileged container can supply a crafted /etc/ld.so.cache file to the uprobe library resolver in Inspektor Gadget. The resolver’s parser trusts the EntryCount field, overflows uint32 arithmetic, and performs byte‑by‑byte immutable string concatenation, causing quadratic work. While this parsing occurs, the container-hook holds the fanotify pause, delaying container startup for about a minute, blocking Docker from starting other no confidentiality or integrity impact; it only causes a denial of service for container startup and excessive CPU consumption.

Inspektor Gadget versions 0.27.0 through 0.53.1 run on Kubernetes clusters and Linux hosts. All included packages have the uprobe library resolver that can be triggered by a crafted /etc/ld.so.cache. The CVE affects the inspektor-gadget product from the stated version range.

The CVSS score of 6.9 reflects a moderate severity. Because the vulnerability is not listed in the CISA KEV catalog and no EPSS score is available, the likelihood of exploitation cannot be quantified. The attack requires an attacker to run an unprivileged container that can write a malicious /etc/ld.so.cache file while an uprobe‑based gadget is active. Successful the start of new containers for roughly a minute, effectively denying service to workloads on the node. No confidentiality or integrity impact is reported, so the threat is limited to availability degradation.