AZL-113432: CVE-2026-97041 affecting package golang 1.26.11-1
Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue affects builds on ELF platforms. Exploitation requires building a malicious Go package that contains the affected //go:cgo_* compiler directives.
What does an attacker need to control to exploit it?
An attacker needs to supply or cause a build to process a malicious package. The package can use commas or a leading @ character in affected symbol-name or dynamic-linker directive values to inject host linker flags or response-file arguments.
Can non-cgo Go source be used in an exploit?
Yes. The two-argument form of //go:cgo_import_dynamic is permitted in non-cgo Go source files and could overwrite the external symbol name of a symbol already marked for cgo export.
How can I tell whether the fix is present?
The fixed compiler and linker reject commas in affected //go:cgo_* symbol and dynamic-linker directives. The linker also passes the dynamic linker using -Wl,--dynamic-linker=<path>, and cgo_import_dynamic no longer overwrites symbols exported through cgo_export_dynamic or cgo_export_static.