AZL-113618: CVE-2026-97037 affecting package python-tensorboard 2.16.2-6
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk. The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to cause a victim to build a malicious package that uses cgo. The package must supply crafted #cgo LDFLAGS that result in linker-script files being passed to the host linker.
Which build environments are exposed?
Exposure is tied to builds using cgo and the host linker, rather than to runtime use of a built package. GNU ld.bfd has additional affected flag cases where regular files supplied as arguments can be interpreted as linker scripts; -Wl,-sectcreate is specifically noted as an issue on non-Darwin platforms.
How can I tell whether a package may be attempting to trigger this behavior?
Review its #cgo LDFLAGS for split -Wl, options whose following token is a bare argument, especially -Wl,-rpath, -Wl,--just-symbols, and -Wl,-undefined. Also inspect uses of -framework, -Wl,-framework, -Wl,-R, -Wl,-subsystem, and the other listed linker options that reference files on disk.
What can be done when an updated Go command is not immediately available?
Avoid building untrusted cgo-enabled packages and review or reject package build flags that pass local files as linker arguments. In particular, do not allow bare second arguments after split -Wl, flags or bare -Wl,--warn-backrefs-exclude usage.