CVE-2026-31890

CVE-2026-31890 impacts Inspektor Gadget versions prior to 0.50.1, where a design flaw causes silent event drops when its eBPF ring-buffer, hard-coded to 256KB, becomes full. This vulnerability is rated Medium (CVSS 5.5) with a local attack vector and low complexity. A low-privileged attacker, such as a compromised container, can exploit this to cause a Denial of Service by forcing the system to drop events from other containers. The issue is exacerbated by the lack of alerts or reported lost counts when events are dropped. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.