CVE-2026-90828: GNU Binutils 2.47 Use-After-Free Vulnerability

CVE-2026-90828 Overview

CVE-2026-90828 is a null pointer dereference vulnerability [CWE-404] in GNU Binutils 2.47. The flaw affects the elf_orphan_compatible function in ld/ldelf.c, part of the ELF Orphan Section Handler component of the GNU linker (ld). An attacker with local access and low privileges can trigger the dereference by supplying a crafted ELF input, causing the linker process to crash. A public exploit has been released, but the impact is limited to availability of the linker process. The upstream project was notified through a bug report and has not yet responded at the time of publication.

Critical Impact
Local low-privileged users can crash the GNU linker by processing a malicious ELF file, disrupting build pipelines and toolchain-dependent workflows.

Affected Products

GNU Binutils 2.47
GNU ld linker component (ld/ldelf.c)
ELF Orphan Section Handler (elf_orphan_compatible)

Discovery Timeline

2026-09-14 - CVE-2026-90828 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90828

Vulnerability Analysis

The vulnerability resides in elf_orphan_compatible, a function inside ld/ldelf.c that determines whether an orphan ELF section can be placed alongside an existing output section. The function operates on section metadata during link-time processing. When the linker encounters an input file with malformed or unexpected orphan section structures, it dereferences a pointer that has not been validated for a null value.

The outcome is a crash of the ld process, classified as improper resource shutdown or release [CWE-404]. The failure occurs entirely within the linker's own address space, so the effect is limited to the availability of the linking operation. There is no memory corruption path documented, and confidentiality and integrity impacts are constrained to what a local user can already observe through a crashing process.

Root Cause

The root cause is missing input validation on section-related pointers passed to elf_orphan_compatible. The function assumes that structural fields returned by earlier parsing stages are always populated. A crafted ELF object supplied as linker input can violate that assumption and reach the dereference site without triggering earlier error paths.

Attack Vector

Exploitation requires local access with at least low privileges. An attacker supplies a malicious ELF object as input to ld, either directly or indirectly through a build system, toolchain wrapper, or continuous integration job that links attacker-controlled objects. The linker crashes when the orphan section is evaluated. The attack cannot be launched remotely and does not grant code execution.

The vulnerability mechanism is described in the Sourceware Bugzilla Report and cataloged in the VulDB CVE-2026-90828 entry. A proof-of-concept attachment is available in the Sourceware Bugzilla Attachment.

Detection Methods for CVE-2026-90828

Indicators of Compromise

Unexpected ld process crashes or SIGSEGV signals during link stages of a build
Build system logs containing internal linker errors referencing orphan section handling
Core dumps produced by ld with faulting addresses inside elf_orphan_compatible
Introduction of untrusted or externally supplied .o or .a files into a link step

Detection Strategies

Monitor build hosts and developer workstations for repeated ld process termination with segmentation faults during ELF linking.
Correlate crash telemetry with the invoking command line to identify which input object triggered the fault.
Inspect CI/CD job logs for linker failures that appear only when specific input artifacts are present.

Monitoring Recommendations

Enable core dump collection on build servers to capture faulting stack traces in ld for post-incident review.
Alert on abnormal exit codes from ld invocations within automated pipelines.
Track integrity of object files entering the link stage, especially those sourced from third parties or upstream package repositories.

How to Mitigate CVE-2026-90828

Immediate Actions Required

Inventory hosts running GNU Binutils 2.47 and identify build systems that link untrusted object files.
Restrict which users and pipelines can supply ELF inputs to ld on shared build infrastructure.
Treat linker crashes in CI/CD as potentially malicious input rather than transient failures until root-caused.

Patch Information

No vendor patch has been published at the time of writing. The upstream Binutils project has been notified through the Sourceware Bugzilla Report but has not yet responded. Track the bug report and the VulDB Vulnerability #403330 entry for updates. Downstream distributions may issue backported fixes ahead of an official Binutils release.

Workarounds

Downgrade to an earlier GNU Binutils release that does not contain the affected code path if operationally feasible.
Validate or sandbox untrusted ELF inputs before passing them to ld on shared or privileged hosts.
Isolate build workers so that a linker crash on one job does not affect other tenants or long-running services.
Restrict local shell access on build systems to reduce the population of users who can invoke ld with arbitrary inputs.

bash

# Verify the installed Binutils version to determine exposure
ld --version | head -n 1

# Restrict execution of ld to a controlled group on shared build hosts
sudo chgrp builders /usr/bin/ld
sudo chmod 750 /usr/bin/ld