CVE-2026-53941: Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS
An unprivileged container can block all other containers from starting on the
same host by placing a crafted /etc/ld.so.cache file in its filesystem. When
Inspektor Gadget attaches any uprobe-based gadget, it parses this file in the
container startup path. A malicious cache causes ~53 seconds of CPU burn,
during which Docker cannot start any other container. No special capabilities
are required.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-53941 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →