CVE-2026-19548: Use After Free in Red Hat Red Hat Enterprise Linux 10
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
AI Analysis
Technical Summary
Multiple use-after-free vulnerabilities exist in the add_archive_element function of ld/ldmain.c in the GNU linker (ld), a component of binutils, as used in Red Hat Enterprise Linux 10. The root cause is that plugin_maybe_claim() frees the original BFD object when entry->the_bfd->my_archive is NULL, but the caller retains dangling pointers (abfd and orig_input.the_bfd) that are later dereferenced at three code locations. This vulnerability is triggered when LTO plugins are active and the input object has abfd->my_archive == NULL, a valid state for standalone object files. Red Hat builds binutils with plugin and LTO support, confirming the vulnerable code path is reachable. An attacker who can supply crafted object or archive files to a build process using LTO-enabled linking could cause a denial of service via linker crash. Although arbitrary code execution is theoretically possible through heap manipulation, it is substantially mitigated by stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments, making supply chain attacks in CI/CD pipelines or development environments the most realistic exploitation scenario. Red Hat has published an advisory but has not confirmed a patch or remediation level.
Potential Impact
The vulnerability allows an attacker who can supply crafted object or archive files during LTO-enabled linking to cause a denial of service by crashing the linker via a segmentation fault. While arbitrary code execution is theoretically possible through heap manipulation, existing system hardening measures significantly reduce this risk. The impact is limited to build-time environments such as CI/CD pipelines and developer workstations, with no exposure in production runtime environments.
Mitigation Recommendations
Red Hat's advisory does not indicate an official fix or patch is currently available. Build environments should avoid running LTO-enabled linking against untrusted or externally supplied object and archive files. The linker is a build-time tool not present in production runtimes, so exposure is primarily to CI/CD pipelines and developer workstations building from untrusted sources. Existing system hardening measures (ASLR, stack protector, FORTIFY_SOURCE, PIE) substantially reduce the likelihood of arbitrary code execution, limiting the realistic impact to denial of service via linker crash. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.
CVE-2026-19548: Use After Free in Red Hat Red Hat Enterprise Linux 10
Description
Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments — the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Multiple use-after-free vulnerabilities exist in the add_archive_element function of ld/ldmain.c in the GNU linker (ld), a component of binutils, as used in Red Hat Enterprise Linux 10. The root cause is that plugin_maybe_claim() frees the original BFD object when entry->the_bfd->my_archive is NULL, but the caller retains dangling pointers (abfd and orig_input.the_bfd) that are later dereferenced at three code locations. This vulnerability is triggered when LTO plugins are active and the input object has abfd->my_archive == NULL, a valid state for standalone object files. Red Hat builds binutils with plugin and LTO support, confirming the vulnerable code path is reachable. An attacker who can supply crafted object or archive files to a build process using LTO-enabled linking could cause a denial of service via linker crash. Although arbitrary code execution is theoretically possible through heap manipulation, it is substantially mitigated by stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments, making supply chain attacks in CI/CD pipelines or development environments the most realistic exploitation scenario. Red Hat has published an advisory but has not confirmed a patch or remediation level.
Potential Impact
The vulnerability allows an attacker who can supply crafted object or archive files during LTO-enabled linking to cause a denial of service by crashing the linker via a segmentation fault. While arbitrary code execution is theoretically possible through heap manipulation, existing system hardening measures significantly reduce this risk. The impact is limited to build-time environments such as CI/CD pipelines and developer workstations, with no exposure in production runtime environments.
Mitigation Recommendations
Red Hat's advisory does not indicate an official fix or patch is currently available. Build environments should avoid running LTO-enabled linking against untrusted or externally supplied object and archive files. The linker is a build-time tool not present in production runtimes, so exposure is primarily to CI/CD pipelines and developer workstations building from untrusted sources. Existing system hardening measures (ASLR, stack protector, FORTIFY_SOURCE, PIE) substantially reduce the likelihood of arbitrary code execution, limiting the realistic impact to denial of service via linker crash. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-08-11T14:15:00.089Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-19548","vendor":"Red Hat"}]
Threat ID: 6a7c97cebf8831d539c533bd
Added to database: 08/12/2026, 15:57:02 UTC
Last enriched: 08/12/2026, 16:17:21 UTC
Last updated: 08/12/2026, 20:13:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.