CVE-2026-40467: Fossies Gawk Use After Free Vulnerability

CVE-2026-40467 Overview

CVE-2026-40467 is a use-after-free vulnerability [CWE-416] in GNU gawk, the GNU implementation of the AWK programming language. The flaw resides in the do_getline_redir() routine within the io.c source file. Processing crafted input through this routine can cause gawk to reference memory that has already been freed, resulting in a process crash. The issue affects gawk versions 5.4.0 and earlier and is tracked by CERT Polska. Exploitation requires local access and does not affect confidentiality or integrity, limiting impact to availability of the gawk process.

Critical Impact
A local attacker can trigger a use-after-free in the do_getline_redir() routine, crashing gawk and disrupting scripts, pipelines, or automation that depend on it.

Affected Products

GNU gawk versions 5.4.0 and below
Systems and distributions bundling vulnerable gawk builds
Automation, build, and data-processing pipelines invoking gawk on untrusted input

Discovery Timeline

2026-07-13 - CVE-2026-40467 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-40467

Vulnerability Analysis

The vulnerability is a use-after-free condition [CWE-416] in the do_getline_redir() function implemented in io.c. This routine handles the getline builtin when input is redirected from a command or file. Under specific conditions, an internal object referenced by the function is freed while a pointer to it remains in use. Subsequent access to that pointer leads to undefined behavior and typically a crash of the gawk interpreter.

The issue is local in nature. An attacker must supply an AWK script or input that reaches the vulnerable code path in do_getline_redir(). Because gawk is often embedded in shell scripts, build systems, log-processing tools, and CI pipelines, an attacker who can influence input passed to such workflows may induce reliable crashes. The impact is limited to availability; there is no reported confidentiality or integrity impact.

Root Cause

The root cause is improper lifetime management of a redirection-related object inside do_getline_redir(). The function releases the object without invalidating all live references, leaving a dangling pointer that is later dereferenced. Details of the fix are available in the upstream commit a2d18c74.

Attack Vector

Exploitation requires local access and the ability to have gawk process attacker-influenced input, such as a malicious AWK script or a crafted data stream feeding a getline redirection. No authentication or user interaction beyond running the affected gawk invocation is required. See the CERT Polska advisory for additional context.

No public proof-of-concept exploit is currently listed for this CVE. The vulnerability mechanism is described in prose only; refer to the upstream patch for the corrected memory-handling logic.

Detection Methods for CVE-2026-40467

Indicators of Compromise

Unexpected gawk process crashes or SIGSEGV signals recorded in system logs (dmesg, journalctl, /var/log/messages).
Core dumps generated from gawk invocations that reference do_getline_redir in the stack trace.
Failing shell scripts, build jobs, or log-processing pipelines that terminate abnormally when parsing untrusted input with getline from a command or file.

Detection Strategies

Inventory installed gawk versions across Linux and Unix hosts and flag any at or below 5.4.0.
Correlate abnormal terminations of gawk with the input sources that were being processed at the time of the crash.
Review AWK scripts used against untrusted input for use of getline with command or file redirection, which reaches the vulnerable routine.

Monitoring Recommendations

Enable core dump collection for gawk and analyze stack traces for frames within io.c and do_getline_redir().
Alert on repeated non-zero exit codes from gawk in CI/CD, ETL, and log-processing workflows.
Track package inventory telemetry to confirm patched gawk builds are deployed across the fleet.

How to Mitigate CVE-2026-40467

Immediate Actions Required

Upgrade gawk to a version that includes upstream commit a2d18c74 as soon as your distribution publishes an updated package.
Audit systems where gawk processes untrusted input and restrict which users and scripts can supply that input.
Validate that automated pipelines using gawk handle abnormal termination without cascading failures.

Patch Information

The upstream fix is committed to the GNU gawk repository as a2d18c74109e41bec29a23098eba2e00057286d8, which corrects the object lifetime in do_getline_redir() within io.c. Apply the fix by installing a gawk release that incorporates this commit, or by rebuilding from source. Consult vendor advisories from your Linux distribution for backported package versions and refer to the CERT Polska advisory for coordinated disclosure details.

Workarounds

Avoid passing untrusted or attacker-controlled input to AWK scripts that use getline with command or file redirection until the patch is applied.
Restrict execution of arbitrary AWK scripts on multi-user systems using standard file permissions and least-privilege accounts.
Sandbox gawk invocations that process untrusted data using tools such as systemd service hardening, seccomp, or containerization to contain crashes.

bash

# Configuration example: verify installed gawk version and upgrade
gawk --version | head -n 1

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade gawk

# RHEL/Fedora
sudo dnf upgrade gawk

# Arch Linux
sudo pacman -Syu gawk