CVE-2026-90802: GNU Binutils Use After Free Vulnerability

CVE-2026-90802 Overview

CVE-2026-90802 is a null pointer dereference vulnerability in GNU Binutils 2.47, specifically within the bfd_putl64 function in bfd/libbfd.c of the ld linker component. An attacker with local access can trigger the flaw by supplying a malformed Executable and Linkable Format (ELF) file during relocation output, causing the linker to crash. The issue was reported through the Sourceware bug tracker as bug #34443. A public proof-of-concept has been disclosed, though the project has not yet acknowledged the report.

Critical Impact
Local attackers can crash the GNU linker ld by supplying a crafted ELF file, disrupting build pipelines and toolchain operations that process untrusted object files.

Affected Products

GNU Binutils 2.47
ld linker component
bfd (Binary File Descriptor) library

Discovery Timeline

2026-09-14 - CVE-2026-90802 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90802

Vulnerability Analysis

The flaw resides in bfd_putl64, a helper routine in the bfd/libbfd.c source file that writes 64-bit little-endian values into a target buffer. When ld processes a malformed ELF object during relocation output, execution reaches bfd_putl64 with a pointer that has not been properly initialized or validated. Dereferencing the null pointer causes a segmentation fault (SIGSEGV) and terminates the linker process.

The categorization under [CWE-404] (Improper Resource Shutdown or Release) reflects the linker's failure to gracefully handle an invalid state during ELF relocation processing. Impact is limited to local availability: the process crashes, but no code execution or information disclosure has been demonstrated.

Root Cause

The bfd library assumes that the destination buffer passed to bfd_putl64 is valid when writing relocation data. A crafted ELF input can produce a code path where this buffer pointer is null, and no defensive check exists before the write. The absence of input validation on structures parsed from the ELF file allows the malformed content to reach the low-level write helper.

Attack Vector

Exploitation requires local access and low privileges. An attacker supplies a malformed ELF object file to ld, either directly or through a build system that invokes the linker on attacker-controlled inputs. When the relocation stage runs, the linker dereferences the null pointer and crashes. The scenario is most relevant in shared build environments, continuous integration runners, and package build systems that link untrusted source artifacts.

A public write-up is available in the GitHub vulnerability report and in the corresponding Sourceware Bug Report #34443.

Detection Methods for CVE-2026-90802

Indicators of Compromise

Unexpected SIGSEGV termination of the ld process during linking stages
Core dumps referencing bfd_putl64 in bfd/libbfd.c around line 989
Build job failures immediately following ingestion of externally sourced ELF object files

Detection Strategies

Monitor build hosts and CI runners for repeated ld crashes correlated with specific object files
Enable core dump collection and inspect stack traces for the bfd_putl64 frame
Scan pipeline inputs for ELF files with malformed relocation sections prior to invoking the linker

Monitoring Recommendations

Alert on process exit code anomalies from ld in automated build environments
Track file provenance for object files submitted to shared toolchain infrastructure
Review audit logs for local users invoking ld against unfamiliar or untrusted ELF inputs

How to Mitigate CVE-2026-90802

Immediate Actions Required

Restrict local access to build systems running GNU Binutils 2.47 to trusted users only
Isolate CI/CD linker workloads in ephemeral containers or sandboxes to contain crashes
Validate the origin and integrity of ELF object files before passing them to ld

Patch Information

No official fix has been published. The upstream project was notified through Sourceware Bug Report #34443 but has not yet responded. Track the VulDB CVE-2026-90802 entry and the Sourceware bug for status updates and pull existing Binutils updates as they become available.

Workarounds

Downgrade to a prior GNU Binutils release not affected by this defect where feasible
Reject or quarantine ELF inputs from untrusted sources before invoking ld
Run build agents under least-privilege service accounts to limit the blast radius of a crash
Apply resource limits and automatic restart policies to build workers to preserve pipeline availability

bash

# Configuration example: restrict ld execution to a dedicated build user
# and enable core dumps for forensic analysis of crashes
chown root:builders /usr/bin/ld
chmod 750 /usr/bin/ld
ulimit -c unlimited
echo '/var/log/coredumps/core.%e.%p' | sudo tee /proc/sys/kernel/core_pattern