AZL-113462: CVE-2026-97041 affecting package golang 1.27.4-1
Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker would need to get a malicious Go package containing crafted //go:cgo_* compiler directives built. Exploitation applies to external linker invocations on ELF platforms and relies on commas or a leading @ in affected directive symbol names or dynamic-linker paths.
What could a successful exploit allow?
The crafted directives could inject arbitrary flags into the host linker invocation. A leading @ could also cause host linker response-file arguments to be processed.
Are non-cgo Go source files relevant?
Yes. The two-argument form of //go:cgo_import_dynamic is permitted in non-cgo Go source files and could overwrite the external symbol name of a symbol already marked for cgo export.
How can I determine whether a package build is exposed?
Review packages being built for //go:cgo_import_dynamic, //go:cgo_export_dynamic, //go:cgo_export_static, //go:cgo_import_static, and //go:cgo_dynamic_linker directives. Directive symbol names or dynamic-linker paths containing commas or beginning with @ indicate the relevant injection conditions.