UBUNTU-CVE-2026-97040: Medium severity ubuntu/golang-1.10 vulnerability
Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgoldflag" or "cgodynamiclinker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments using the listed Ubuntu golang packages are exposed when they build a package containing an attacker-controlled or otherwise untrusted .syso file. Pure-Go builds can also be affected because an unrecognized .syso format could force external linking.
What does an attacker need to exploit it?
The attacker needs to cause a crafted .syso file to be included in a package being built. The file can begin with a Go object header and contain untrusted cgo metadata directives, such as cgo_ldflag or cgo_dynamic_linker, that are passed to the external linker without validation.
What should be done if updates cannot be applied immediately?
Do not build packages that include untrusted .syso files. Review package sources and build inputs for .syso files, especially unusually formatted files or files carrying embedded Go object data and cgo metadata directives.
How can I identify potentially affected build inputs?
Inspect package archives and source trees for .syso members, including filenames longer than 16 bytes whose archive names may have lost the .syso suffix through truncation. Treat .syso files that are not recognized ELF, Mach-O, PE, or XCOFF host objects as suspicious.