Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-31890 is a medium-severity Omission of Security-relevant Information (CWE-223) vulnerability in Linuxfoundation Inspektor Gadget. Its CVSS base score is 4.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Denial of Service (T1498); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-10 (Concurrent Session Control) and AU-12 (Audit Record Generation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-11641
Vulnerability Data
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously…
more
– already full, the gadget will silently drop events. The include/gadget/buffer.h file contains definitions for the Buffer API that gadgets can use to, among the other things, transfer data from eBPF programs to userspace. For hosts running a modern enough Linux kernel (>= 5.8), this transfer mechanism is based on ring-buffers. The size of the ring-buffer for the gadgets is hard-coded to 256KB. When a gadget_reserve_buf fails because of insufficient space, the gadget silently cleans up without producing an alert. The lost count reported by the eBPF operator, when using ring-buffers – the modern choice – is hardcoded to zero. The vulnerability can be used by a malicious event source (e.g. a compromised container) to cause a Denial Of Service, forcing the system to drop events coming from other containers (or the same container). This vulnerability is fixed in 0.50.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 11 hardening rules · 5 OS baselines
V15.4.4
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces a hard limit on concurrent sessions, structurally preventing unbounded resource allocation.
Ensures the system can generate audit records for defined events, reducing the chance of systematic omission.
Requires identification and logging of security-relevant event types, directly stopping omission of attack or safety information.
Mandates that audit records contain the specific details needed to identify sources, nature, and safety of actions.
Requires explicit allocation of resources by priority or quota, directly stopping unlimited allocation.
Imposes a limit on consecutive invalid attempts, preventing one specific class of unbounded resource consumption.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
CWE-223 omits exactly the security details that DE.AE-02's log analysis and SIEM monitoring rely on, largely blinding the outcome while still leaving non-omitted data usable.
CWE-223's omission of attack-relevant details largely blinds impact/scope estimation (DE.AE-04), removing most of its efficacy while not quite defeating every possible manual or external-data workaround.
CWE-223 directly omits the security-relevant data that DE.AE-06 must deliver, largely defeating the outcome's purpose while not always eliminating every possible channel.
CWE-223 omits the raw security data that DE.AE-07 must integrate with CTI, largely starving the analysis outcome in both directions.
Missing security-relevant data largely blinds the criteria-based incident declaration process, removing most of its efficacy without making it completely impossible.
CWE-223 omission directly blinds DE.CM-06 monitoring of external-provider activity by withholding the very security-relevant data needed to detect adverse events, impairing most (but not all) of the outcome's scope.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Logging directly requires recording security-relevant events that the weakness omits.
Baseline comparison of CPU, memory and bandwidth usage helps surface uncontrolled resource allocations before they cause service degradation.
Capacity projections and elasticity measures ensure that allocation requests are bounded and can be throttled, reducing the window in which an attacker can force unbounded resource reservations.
Evidence collection depends on logs and records that the weakness fails to produce.
Defining retention periods and deletion schedules for backup copies prevents indefinite accumulation of data on storage media without corresponding resource-management controls.
Architectural redundancy and automatic failover limit the impact of an attacker who forces excessive allocations, because spare capacity can absorb the load until the primary instance recovers.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248552 OL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-770
- V-248553 OL 8 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-770
Oracle Linux 9 (2 rules)
- V-271710 OL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive. prevents CWE-770
- V-271709 OL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-770
RHEL 8 (1 rule)
- V-230244 RHEL 8 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive. prevents CWE-770
Ubuntu 22.04 (2 rules)
- V-260591 Ubuntu 22.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223
- V-260590 Ubuntu 22.04 LTS must have the "auditd" package installed. prevents CWE-223
Ubuntu 24.04 (2 rules)
- V-270656 Ubuntu 24.04 LTS must have the "auditd" package installed. prevents CWE-223
- V-270657 Ubuntu 24.04 LTS must produce audit records and reports containing information to establish when, where, what type, the source, and the outcome for all DOD-defined auditable events and actions in near real time. prevents CWE-223