CVE-2026-48496

What it actually does

An unprivileged local process can supply a non-regular file such as a FIFO as a mapping target, causing the profiler to block indefinitely during ELF analysis and halting further profiling operations.

Why it matters to the business

Profiling and observability for applications stop working on affected hosts, degrading performance monitoring, troubleshooting, and capacity planning until the agent is restarted or upgraded.

How an attack unfolds

An attacker on the same host creates a FIFO or similar non-regular file, then induces the profiler to treat it as an ELF mapping; the open call blocks forever, starving the ELF analysis queue and producing a denial of service.

How to fix it

Upgrade the OpenTelemetry eBPF Profiler to version 0.0.202622 or later; no configuration workarounds exist.

How to confirm the fix worked

Confirm the running binary reports version 0.0.202622 or newer; attempt to present a FIFO mapping and verify the profiler continues processing other targets without blocking.

Typical attack path

1. Identify a running OpenTelemetry eBPF Profiler instance on a shared host
2. Create a FIFO or other non-regular file in a location the profiler may scan
3. Trigger the profiler to open the file as a mapping target
4. Observe indefinite blocking and loss of subsequent ELF analysis

How to detect it

Review profiler logs for repeated or stalled ELF mapping attempts; watch for processes that remain in uninterruptible sleep while opening files under the profiler's working directories.

What your security team should do

• Schedule upgrade to 0.0.202622 across all deployments within the next change window
• Add the profiler package to automated vulnerability scanning and patch pipelines
• Monitor process health of the profiler agent for unexpected blocking or restarts