Use-After-Free Vulnerabilities in GNU Linker by Red Hat

CVE-2026-19548

What is CVE-2026-19548?

Multiple Use-After-Free vulnerabilities exist in the add_archive_element function of the GNU linker, part of the binutils package. The issue stems from the improper handling of dangling pointers when certain conditions are met, particularly when LTO plugins are used. An attacker can exploit this by supplying a malicious object or archive file during the build process, potentially leading to a denial of service due to linker crashes. Although arbitrary code execution is theoretically possible, it remains limited mainly to controlled development environments where the linker is employed. Mitigation strategies in place, such as stack protection and ASLR, significantly reduce the risks associated with these vulnerabilities.

References