Answer in brief
CVE-2026-97041 records a Unknown severity vulnerability in Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link. The current sources do not mark it as known exploited. The current feed maps Go toolchain/cmd/compile (generic), Go toolchain/cmd/link (generic), toolchain (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Go toolchain/cmd/compile (generic), Go toolchain/cmd/link (generic), toolchain (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Go toolchain/cmd/compilegeneric | >=0 <1.26.11 || >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
| Go toolchain/cmd/linkgeneric | >=0 <1.26.11 || >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
| toolchaingo | >=0 <1.26.11 >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".
Quoted source text, attributed separately from HOL analysis.