Executive brief
GNU Binutils is a critical set of tools used by developers and build systems to link and manipulate compiled object files. A null pointer dereference vulnerability in the SHT_GROUP section handler can cause the linker (ld) to crash when processing malformed object files during relocatable linking. While a local attacker or malicious build artifact could trigger this crash, the impact is limited to denial of service (build failure) rather than code execution.
Technical details
The vulnerability is a null pointer dereference in the bfd_elf_set_group_contents() function (bfd/elf.c:3952) triggered during relocatable linking (-r flag). The root cause is incomplete validation of SHT_GROUP section linkage; a malformed or corrupted group section can leave a NULL pointer that is subsequently dereferenced without null checks. The attack vector is local and requires the attacker to supply a specially crafted ELF object file as input to the linker. An exploit proof-of-concept has been made public. The vulnerability affects binutils 2.47 and possibly earlier versions; the GNU project has not yet responded to the bug report or provided a patch.
Affected products
- GNU Binutils 2.47
Timeline
- 2026-07-28: disclosed: Bug report filed
- 2026-09-14: advisory: CVE-2026-90829 published
- 2026-07-28: other: PoC publicly available via bugzilla attachment