ALPINE-CVE-2026-97037: Alpine/go vulnerability
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/goto a version that resolves this vulnerability.Fixed in 1.26.11-r0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that build or compile untrusted Go packages using cgo are exposed. The risk occurs during the build/link step, so it affects build workers and developer systems processing malicious package source rather than only software produced by the build.
What does an attacker need to exploit it?
An attacker needs to cause a cgo-enabled build to use malicious #cgo LDFLAGS. The malicious flags can make the host linker process a regular file as a linker script, resulting in arbitrary code execution at link time.
Are all host linkers affected in the same way?
No. The bare second-argument handling affects split -Wl, flags such as -Wl,-rpath, -Wl,--just-symbols, and -Wl,-undefined. Additional linker-script interpretation cases are specifically described for GNU ld.bfd.
What mitigations are available if patching cannot happen immediately?
Do not build untrusted Go packages that use cgo, and review or restrict #cgo LDFLAGS in packages that must be built. Isolate build environments because exploitation occurs during linking.
How can I identify potentially malicious build flags?
Inspect #cgo LDFLAGS for split -Wl, options whose following argument lacks a -Wl, prefix, and for linker options that reference regular files. Pay particular attention to -Wl,-rpath, -Wl,--just-symbols, -Wl,-undefined, -framework, -Wl,-framework, -Wl,-R, -Wl,-subsystem, and -Wl,-sectcreate on non-Darwin platforms.