GO-2026-6854: Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Q: Who is exposed to this issue?

Build environments that run the Go command on untrusted or malicious packages using cgo are exposed. Exploitation occurs during linking, so it can affect developers, CI workers, and other systems that build such packages.

Q: What does an attacker need to exploit it?

An attacker needs to supply a package that uses cgo and includes crafted #cgo LDFLAGS. The vulnerable handling can cause the host linker to consume an attacker-selected regular file as a linker script during the build.

Q: Are only Darwin builds affected?

No. The issue includes split -Wl, flags and behavior of GNU ld.bfd. Some affected flags are Darwin-specific, while -Wl,-sectcreate is specifically relevant on non-Darwin platforms.

Q: What changed to prevent exploitation?

The Go command now requires the second token of split -Wl, flags to also have a -Wl, prefix, except for -Wl,-R. It also checks that affected flags do not reference linker script files and rejects bare -Wl,--warn-backrefs-exclude.

Published Nov 11, 2026

Updated

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS".

Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.

The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".

Affected Software

2 affected componentsFixes available

go/toolchain<1.26.11

1.26.11

go/toolchain>=1.27.0-0<1.27.4

1.27.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.26.11
Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.27.4
Configuration
Update cgo LDFLAGS so split -Wl, flags that consume a following argument use the -Wl, prefix on that second token (except -Wl,-R), do not use bare -Wl,--warn-backrefs-exclude, and ensure the flags do not reference linker script files.
cgo LDFLAGS split -Wl, flag argument handling = Require a -Wl, prefix on the second token, except for -Wl,-R; disallow bare -Wl,--warn-backrefs-exclude; do not reference linker script files

Event History

Nov 11, 2026

Advisory Published

via OSV·02:51 AM

Data Sourced

via OSV·02:51 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Build environments that run the Go command on untrusted or malicious packages using cgo are exposed. Exploitation occurs during linking, so it can affect developers, CI workers, and other systems that build such packages.

What does an attacker need to exploit it?

An attacker needs to supply a package that uses cgo and includes crafted #cgo LDFLAGS. The vulnerable handling can cause the host linker to consume an attacker-selected regular file as a linker script during the build.

Are only Darwin builds affected?

No. The issue includes split -Wl, flags and behavior of GNU ld.bfd. Some affected flags are Darwin-specific, while -Wl,-sectcreate is specifically relevant on non-Darwin platforms.

What changed to prevent exploitation?

The Go command now requires the second token of split -Wl, flags to also have a -Wl, prefix, except for -Wl,-R. It also checks that affected flags do not reference linker script files and rejects bare -Wl,--warn-backrefs-exclude.

GO-2026-6854: Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are only Darwin builds affected?

What changed to prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are only Darwin builds affected?

What changed to prevent exploitation?