CVE-2026-19548

Technical Description

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element:

1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive)

2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call

3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging

The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for

Remediation

Check the references section for vendor advisories and patches from redhat. Update hardened_images to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References