Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT. https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
I've looked at the upstream issue: https://sourceware.org/bugzilla/show_bug.cgi?id=33455 H.J. Lu has proposed a patch which might fix the linker issue, but it has not yet been committed/pushed. My analysis shows that GDB does not call the function which H.J. has changed in his proposed patch, but, since that patch isn't upstream yet, I cannot close this as NOTABUG. Also, even if it is a bug, there is no backport available, as proposed patches should not be backported. Therefore, I've assigned it to myself and will leave it open until there's movement on the upstream bug.
Closing as NOTABUG – per the GNU Debugger Security Policy CVE‑2025‑11840 concerns an out‑of‑bounds read in libbfd’s COFF loader (`coff_slurp_reloc_table`). The only effect that can surface in GDB is a non‑privileged crash (due to an attempted NULL pointer dereference) when the gdb‑compile module loads a COFF object with a malformed relocation. * The gdb‑compile module, when used on Linux, generates ELF objects and executables; it does NOT produce COFF files. Consequently, under normal Linux usage the COFF‑related path that contains the vulnerability is never exercised. * Triggering the bug would require deliberately constructing a COFF file whose relocation’s `howto->name` is NULL and then loading that file via gdb‑compile – a highly contrived scenario that is not encountered in typical debugging sessions. * The bug does NOT cross a privilege boundary, does not cause the inferior program to run without an explicit GDB command, and does not permit arbitrary code execution in the debugger. According to the policy section “What Is Not A Security Bug”, an internal error that results merely in a crash is NOT a security bug. Therefore this issue does not meet any of the four criteria that define a security bug for GDB, and it should be closed as NOTABUG. References: - gdb/SECURITY.txt – “What Is Not A Security Bug” (items 1‑4) - Binutils bug #33455 (https://sourceware.org/bugzilla/show_bug.cgi?id=33455) - CVE‑2025‑11840 (https://access.redhat.com/security/cve/cve-2025-11840)