AZL-113597: CVE-2026-97034 affecting package python-tensorboard 2.16.2-6
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib". The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed during builds?
Exposure is limited to builds that use GCC and compile a malicious package using cgo. The relevant cgo linker flags are -fopenmp, -fopenacc, or -fsanitize=.
What must an attacker control to trigger execution?
An attacker needs to cause a malicious cgo package to be built and arrange for an untrusted GCC spec file to be found during linking. GCC may search -L and sysroot directories, related subdirectories or multilib sibling directories, and in some cases the working directory.
How can build pipelines reduce risk before updating?
Do not allow untrusted GCC specs or *.spec files in directories supplied through -L, -isysroot, or -Wl,-syslibroot. Also avoid unsafe -fsanitize= values beginning with @ or -, and prevent spec files from being placed in the working or package directories when the applicable linker flags are used.
How can teams check whether a build configuration is risky?
Review #cgo LDFLAGS for -fopenmp, -fopenacc, or -fsanitize=, then inspect the configured library and sysroot search paths for specs or *.spec files. Include working and package directories where -fopenmp or -fopenacc is used, or where -fsanitize= is combined with -static or -static-lib*.