CVE-2026-97038 is a vulnerability in the Go build process where malicious packages containing ".syso" files or cgo linker inputs can inject arbitrary linker flags or execute code at link time. This occurs because linker input files were passed to the external linker without proper validation, allowing execution of disguised linker scripts or injection of unallowlisted linker flags. The Go command now enforces validation to prevent these attacks.