UBUNTU-CVE-2026-97041: Medium severity ubuntu/golang-1.10 vulnerability
Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic", "//go:cgoimportstatic", and "//go:cgodynamiclinker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgoimportdynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgoimportdynamic" no longer overwrites symbols exported via "cgoexportdynamic" or "cgoexportstatic".
Affected Software
Event History
Frequently Asked Questions
Which environments are realistically exposed?
Ubuntu systems using the listed golang packages are relevant when they build a malicious Go package on an ELF platform. The issue affects the external linker invocation during compilation rather than a running Go application by itself.
What does an attacker need to exploit this?
An attacker needs to cause a build process to compile a package containing crafted //go:cgo_* directives. Commas or a leading @ in directive-controlled symbol names or dynamic-linker paths can be used to inject host linker flags or response-file arguments.
Which Ubuntu Go packages should be reviewed?
Review ubuntu/golang-1.6, ubuntu/golang-1.8, ubuntu/golang-1.10, ubuntu/golang-1.13, ubuntu/golang-1.16, ubuntu/golang-1.18, ubuntu/golang-1.22, and ubuntu/golang-1.24. The supplied data does not include fixed package versions.