Bug 2571447 (CVE-2026-97041)

Summary: CVE-2026-97041 cmd/compile: cmd/link: golang: golang: Arbitrary code execution via external linker flag injection
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, cahl, crizzo, dfreiber, dpaolell, drow, dymurray, jburrell, jdelft, jupierce, kaycoth, lgarciaa, ljawale, mbiarnes, msilmser, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sdawley, sghai, sidsharm, suppawar, vkumar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Go compiler and linker. This vulnerability allows an attacker to achieve arbitrary code execution on systems building Go software by injecting unauthorized flags into the external linker. The issue occurs on Executable and Linkable Format (ELF) platforms because the compiler and linker fail to properly validate special compiler directives embedded within Go source files. A remote attacker can exploit this flaw by tricking a user or automated pipeline into compiling a malicious Go package, leading to the compromise of the build host.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 03:21:39 UTC 
Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".