UBUNTU-CVE-2026-97039: Medium severity ubuntu/golang-1.10 vulnerability
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the go command's pkg-config handling to reject these options and package arguments so untrusted local .pc files cannot be loaded and linker search paths cannot be rewritten.
go command pkg-config flag allowlist allowed pkg-config options and package arguments = Disallow --with-path=, --personality=, --define-variable= values beginning with = or $, local .pc paths, package arguments ending in .pc, package arguments containing path separators, and package arguments containing ..
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that build untrusted or malicious Go packages using cgo are exposed. The issue is triggered during package building through #cgo pkg-config directives and pkg-config output handling.
What does an attacker need to exploit it?
An attacker needs to cause a target to build a package containing crafted #cgo pkg-config directives, or otherwise influence the pkg-config data used during that build. Crafted arguments could cause local or untrusted .pc files to be loaded or pass unvalidated compiler and linker flags.
How can I identify potentially affected source packages?
Inspect #cgo pkg-config directives for --with-path=, --personality=, --define-variable= values beginning with = or $, package arguments ending in .pc, and arguments containing path separators or .. . These forms are now disallowed by the go command.
What should be done if updates cannot be applied immediately?
Do not build untrusted packages that use cgo and pkg-config directives. Review build inputs and .pc files, and reject directives using local .pc paths or the previously permitted pkg-config options described in the advisory.
Is internal linking relevant to triage?
Yes. The issue also concerns compiler flags returned by pkg-config --cflags in cgoCPPFLAGS, which were previously omitted when determining whether internal linking was safe.