CVE-2026-48496: 
Chainguard vulnerability analysis and mitigation

CVE-2026-48496 is a denial-of-service vulnerability in the OpenTelemetry eBPF profiler (go.opentelemetry.io/ebpf-profiler) that allows an unprivileged local process to permanently block the processPIDEvents goroutine, rendering the profiler agent inoperable. The vulnerability affects versions >= 0.0.202527 and was patched in version 0.0.202622. It was reported by Alban Crequy, published as a security advisory on June 3, 2026, and added to the GitHub Advisory Database on June 23, 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code path in process/process.go used a plain openat2 syscall to open ELF files from process memory mappings without guarding against blocking file types such as FIFOs or sockets. An unprivileged process could place a FIFO or socket at a path that the profiler would attempt to open, causing the openat2 syscall — and thus the processPIDEvents goroutine — to block indefinitely. The fix (commit 234b685) introduces an openInRoot() helper that uses openat2 with O_PATH first (which never blocks on FIFOs or sockets), verifies the target is a non-empty regular file via fstat, and then reopens it for reading, also adding RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS flags to prevent symlink escapes from containers (GitHub Advisory, Fix Commit).

Successful exploitation results in a complete denial of service of the eBPF profiler agent: the processPIDEvents goroutine becomes permanently blocked and can no longer analyze new ELF files, effectively disabling continuous profiling for all monitored workloads on the host. There is no confidentiality or integrity impact — no data is exfiltrated or modified. The scope is limited to the profiler agent itself; however, in environments relying on the profiler for observability or security monitoring, its loss could create blind spots (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is 0.017% (4th percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only local access with no privileges, making it trivially achievable by any unprivileged workload co-located on the same host as the profiler agent (GitHub Advisory).

1. Identify target: Confirm the target host is running the OpenTelemetry eBPF profiler agent (go.opentelemetry.io/ebpf-profiler) at a vulnerable version (>= 0.0.202527, < 0.0.202622).
2. Create a blocking file: As an unprivileged process on the same host, create a named pipe (FIFO) or Unix domain socket at a filesystem path that the profiler will attempt to open when scanning process memory mappings (e.g., a path that appears as a mapped file in /proc/<pid>/maps).
3. Trigger profiler access: Arrange for the malicious process's memory map to reference the FIFO/socket path, so that when the profiler's processPIDEvents goroutine processes the PID event, it calls openat2 on the blocking file.
4. Goroutine blocked: The openat2 syscall blocks indefinitely waiting for a reader/writer on the FIFO, permanently stalling the processPIDEvents goroutine.
5. Profiler disabled: With the goroutine blocked, the eBPF profiler can no longer analyze any new ELF files or process new PID events, achieving a sustained denial of service of the agent (GitHub Advisory, Fix Commit).

• Process: The opentelemetry-ebpf-profiler process has a goroutine permanently stuck in the openat2 syscall; this can be observed via strace -p <pid> or by inspecting /proc/<pid>/syscall showing a long-running openat2 call.
• Logs: Absence of new profiling data or ELF analysis events in profiler logs after a certain point; the profiler may appear running but produce no output.
• File System: Presence of unexpected named pipes (FIFOs) or Unix sockets at paths that appear in process memory maps (/proc/<pid>/maps) of co-located workloads.
• Process: Profiler goroutine count stagnation or the processPIDEvents goroutine not making progress, detectable via Go runtime metrics or pprof goroutine dumps.

Upgrade the go.opentelemetry.io/ebpf-profiler Go module to version 0.0.202622 or later, which contains the fix in commit 234b685 (Fix Commit, Release v0.0.202622). No configuration-based workaround is available; upgrading is the only remediation. Organizations running the profiler in multi-tenant or shared environments should prioritize patching, as any unprivileged workload on the host can trigger the issue.