UBUNTU-CVE-2026-97036: Medium severity ubuntu/golang-1.10 vulnerability
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects builds performed on Darwin using the Apple linker. The listed Ubuntu golang packages are relevant when they are used to build cgo-enabled code for that environment.
What must an attacker control to exploit it?
An attacker must be able to supply or induce use of a malicious package containing a crafted #cgo LDFLAGS directive. The directive uses separated arguments that the Apple linker recombines to load an arbitrary LTO plugin library during linking.
Does exploitation occur in a running application?
No. The described arbitrary code execution occurs at build/link time, when the go command invokes the Apple linker for the malicious cgo package.
What protections does the updated go command add?
It rejects -l followed by to_library, as well as -lazy_library, -lazy_framework, -load_hidden, -library, and -library-path in #cgo LDFLAGS. It also checks recombined -l arguments against disallowed linker flags and patterns.