The golang packages in Red Hat Enterprise Linux contain a vulnerability identified as CVE-2025-61731, which allows arbitrary file write through a malicious pkg-config directive in the cmd/go tool. This flaw could potentially be exploited to write files arbitrarily during the build process. Red Hat has issued security advisories RHSA-2026:5943 and RHSA-2026:5944 providing updated golang packages that fix this vulnerability. The advisories cover multiple architectures including x86_64, s390x, ppc64le, and aarch64, and various versions of Red Hat Enterprise Linux including 9.6 and 10.0 Extended Update Support releases. The vendor advisory includes detailed package updates and instructions for remediation.

The vulnerability allows an attacker to perform arbitrary file writes via a malicious pkg-config directive when using the Go compiler's cmd/go tool. This could lead to unauthorized modification of files during build processes, potentially compromising system integrity or enabling further attacks. Red Hat rates the security impact as Important (high severity). There are no known exploits in the wild at this time.

Red Hat has released updated golang packages that fix this vulnerability. Users should apply the official updates as described in Red Hat advisory RHSA-2026:5943 and RHSA-2026:5944. Detailed instructions for applying these updates are available at https://access.redhat.com/articles/11258. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are indicated by the vendor.