CVE-2026-48496: opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
Summary
An unprivileged process can easily trigger the processPIDEvents goroutine to be blocked indefinitely, preventing the goroutine from analyzing any new ELF file. The goroutine stays blocked in the openat2 syscall forever and the profiler can no longer work properly, it is a denial of service.
Impact
The impact is limited to denial-of-service on the ebpf-profiler agent: - There has to be a malicious workload albeit unprivileged. - No exfiltration of data. No loss of data.
Fix
Fixed in https://github.com/open-telemetry/opentelemetry-ebpf-profiler/commit/234b685cab31c2cb2f79e966caeab168bcc489e4.
Fix is part of v.0.0.202622.
Other sources
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/go.opentelemetry.io/ebpf-profilerto a version that resolves this vulnerability.Fixed in 0.0.202622 - Upgrade
Upgrade
open-telemetry/opentelemetry-ebpf-profilerto a version that resolves this vulnerability.Fixed in 0.0.202622 - Compensating control
Until upgraded to v0.0.202622, mitigate the DoS risk by preventing unprivileged processes from triggering the profiler’s PID event path (e.g., restrict access to the profiler’s trigger/IPC mechanisms and/or isolate workloads so untrusted workloads cannot interact with the ebpf-profiler agent).
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-48496?
CVE-2026-48496 has a risk level of 36.
What is the severity of CVE-2026-48496?
The severity of CVE-2026-48496 is medium with a score of 6.2.
How can I mitigate CVE-2026-48496?
To mitigate CVE-2026-48496, ensure that you update to the latest version of the OpenTelemetry eBPF profiler that addresses this vulnerability.
What impact does CVE-2026-48496 have on system performance?
CVE-2026-48496 can lead to denial of service by blocking the profiler from analyzing new ELF files indefinitely.
Who can exploit CVE-2026-48496?
An unprivileged process can exploit CVE-2026-48496, causing the profiler's functionality to degrade.