Re: RFC: Fix for CVE-2026-19548

On Thu, Aug 13, 2026 at 09:52:28AM +0100, Nick Clifton wrote:
> Hi Guys,
> 
>   CVE-2026-19548 points out a potential use-after-free bug in the
>   add_archive_element() function in ld/ldmain.c.  After looking at
>   it it seemed to me that the simplest solution was to keep a copy
>   of the my_archive pointer so that there is no need to dereference
>   the freed bfd structure.  As is done in the attached, proposed
>   patch.  Any comments ?
> 
> Cheers
>   Nick
> 
> PS. According to the SECURITY.txt statement this bug does not really
>   qualify for CVE status, but that is a separate issue from actually
>   fixing the bug.
> 
> https://nvd.nist.gov/vuln/detail/CVE-2026-19548

The bug report says:
"The vulnerability is triggered when LTO plugins are active
(link_info.lto_plugin_active is true) and the input object has
abfd->my_archive == NULL"

If my_archive is NULL the bfd isn't an archive member!

How is it that add_archive_element is being called for something that
isn't a member of an archive?  Do you have a testcase?

Hmm..  This is likely a bug in e34fd4bfa6d7.  I see a bfd_release in
_bfd_compute_and_push_armap that will lose the memory for
ardata->symdefs set up in _bfd_load_armap.

-- 
Alan Modra