CVE-2026-24905 Inspektor Gadget has a Command Injection vulnerability in Makefile.build

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The ig binary provides a subcommand for image building, used to generate custom gadget OCI images. A part of this functionality is implemented in the file...

CVE-2026-24905 Inspektor Gadget has a Command Injection vulnerability in Makefile.build

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The ig binary provides a subcommand for image building, used to generate custom gadget OCI images. A part of this functionality is implemented in the file...

CVE-2026-24905

CVE-2026-24905 affects Inspektor Gadget. The vulnerability arises from unsafe embedding of user-controlled data in the Makefile.build template used during ig image build, allowing command injection via buildOptions extracted from the gadget manifest. Before version 0.48.1, an attacker who can inf...

Inspector Gadget operating system command injection vulnerability

Inspector Gadget is a set of tools and frameworks based on eBPF developed by Inspector Gadget Inc. Versions of Inspector Gadget prior to 0.48.1 contained a vulnerability related to operating system command injection. This vulnerability stemmed from improper embedding of user-controlled data durin...

PT-2026-5359

Name of the Vulnerable Software and Affected Versions Inspektor Gadget versions prior to 0.48.1 Description Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The ig binary includes a subcommand for image...

ROS-20260128-73-0013

A vulnerability in the drivers/usb/gadget/function/uaudio.c module of the Linux operating system kernel is related to file descriptor depletion. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005062)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005062 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix race between aiocancel and AIO request complete FFS based applications can...

nullsec-exploit

💀 NullSec Exploit Advanced Exploit Development & Payload...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42085)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42085 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mod...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21859)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21859 advisory. - In the Linux kernel, the following vulnerability has been resolved: USB: gadget: fmidi: fmidicomplete to cal...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37812)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37812 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix deadlock when using NCM...

Azure Linux 3.0 Security Update: kernel (CVE-2024-50056)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-50056 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: Fix ERRPTR dereference...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37810)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37810 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event coun...

Azure Linux 3.0 Security Update: kernel (CVE-2025-37881)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-37881 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed: Add NULL pointer...

ROS-20260121-73-0014

A vulnerability in the drivers/usb/gadget/udc/core.c component of the Linux kernel is related to memory usage after memory is freed. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-50116: kernel: tty: ngsm: fix deadlock and link starvation in outgoing data path bsc1244824. CVE-2024-53177: smb: prevent use-after-free due to opencacheddir...

ROS-20260119-7387

A vulnerability in the usbgcmdwork and botcmdwork functions of the USB driver drivers/usb/gadget/function/ftcm.c of the Linux kernel is related to memory re-release. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003584)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003584 advisory. In the Linux kernel before 4.16.4, a double-locking error in drivers/usb/dwc3/gadget.c may potentially cause a deadlock with fhid. Tenable has extracted the precedin...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001374 advisory. In gadgetdevdescUDCshow of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004301 advisory. gadgetdevdescUDCstore in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup without considering the possibility of an internal...