opentelemetry-ebpf-profiler CVE-2026-48496

The affected package is the Go module go.opentelemetry.io/ebpf-profiler (CPE: pkg:go/go.opentelemetry.io_ebpf-profiler), an eBPF-based continuous profiling agent from the OpenTelemetry project. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the original getMappingFile implementation constructed filesystem paths and called os.Open() directly without first verifying that the target was a regular file. On Linux, opening a FIFO (named pipe) or Unix domain socket with a standard open() syscall blocks indefinitely until a peer opens the other end - a behavior the kernel intentionally provides. Because the processPIDEvents goroutine made no such check before calling openat2, a malicious process could place a FIFO at a path within its own filesystem namespace (e.g., /proc/<pid>/root/...) that the profiler would resolve and attempt to open. The fix introduces an openInRoot helper that uses the O_PATH flag first (which never blocks on special files), performs an fstat to assert S_IFREG and non-zero size, then reopens via /proc/self/fd/<fd>. The fix also adds inode/device matching to prevent file substitution attacks and uses RESOLVE_IN_ROOT | RESOLVE_NO_MAGICLINKS to prevent symlink escapes from containers.