A malicious container can crash or destabilize the privileged Inspektor Gadget process when a gadget using USDT probes is deployed. The vulnerability is in the USDT note parser ("pkg/uprobetracer/usdt.go") which is invoked when a gadget with a "SEC("usdt/...")" section attaches to a target binary. An unprivileged process can place a crafted ELF binary at the expected library path, triggering one of two attack vectors: 1. Panic (immediate crash): A stapsdt note with a small "DescSize" causes an out-of-bounds slice access, panicking the IG process. 2. Memory exhaustion (OOM kill): A stapsdt note with a very large "NameSize" or "DescSize" causes IG to allocate up to ~4 GiB of memory, which can killnthe process if deployed with memory restrictions (e.g., cgroup limits). Important: The vulnerability is only triggered when running a gadget that uses USDT probes (i.e., contains a "SEC("usdt/...")" eBPF section). No gadget shipped by the Inspektor Gadget project uses USDT today. Users who deploy their own custom USDT gadgets are affected.