CVE-2025-69650: 
NixOS vulnerability analysis and mitigation

CVE-2025-69650 is a double free vulnerability (CWE-415) in GNU Binutils readelf through version 2.46, triggered when processing a crafted ELF binary with malformed relocation data. During GOT relocation handling, dump_relocations may return early without initializing the all_relocations array, causing process_got_section_contents() to pass an uninitialized r_symbol pointer to free(), resulting in a double free and program termination via SIGABRT. The vulnerability was published on March 6, 2026, and carries a CVSS v3.1 base score of 7.5 (High). Notably, the CVE is disputed by third parties who assert the observed behavior occurred only in pre-release code and did not affect any tagged release version (Feedly, Sourceware Bugzilla).

The root cause is a double free condition (CWE-415) in the readelf component of GNU Binutils. When dump_relocations() encounters malformed relocation data in a crafted ELF binary and returns early, the all_relocations array is left uninitialized. Subsequently, process_got_section_contents() calls free() on the uninitialized r_symbol pointer, triggering the double free. No exploitable memory corruption or code execution path was identified; the impact is strictly a denial of service via SIGABRT. A fix is available as commit ea4bc025abdba85a90e26e13f551c16a44bfa921 in the Binutils-GDB git repository (Sourceware Bugzilla, Sourceware Patch).

Successful exploitation causes readelf to crash with SIGABRT, resulting in a denial of service. No confidentiality or integrity impact has been identified, and no evidence of exploitable memory corruption or arbitrary code execution was observed. The impact is limited to availability of the readelf tool when processing untrusted ELF binaries (Feedly).

There are no confirmed public exploits or evidence of in-the-wild exploitation for CVE-2025-69650. The EPSS score is approximately 0.019% (0.000190), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Additionally, the CVE is disputed, with third parties asserting it only affected pre-release code and not any official tagged release of GNU Binutils (Feedly, Sourceware Bugzilla).

1. Craft a malicious ELF binary: Create or modify an ELF binary to include malformed relocation data in the GOT section that causes dump_relocations() to return early without initializing the all_relocations array.
2. Deliver the binary: Provide the crafted ELF file to a target system where readelf is invoked on untrusted input (e.g., automated build pipelines, binary analysis tools, or CI/CD environments).
3. Trigger the vulnerability: Execute readelf against the crafted binary (e.g., readelf -a malicious.elf). The malformed relocation data causes dump_relocations() to exit early, leaving r_symbol uninitialized.
4. Achieve denial of service: process_got_section_contents() passes the uninitialized pointer to free(), triggering a double free condition that terminates readelf with SIGABRT (Sourceware Bugzilla, Feedly).

• Process: readelf process terminating abnormally with SIGABRT signal when processing ELF binaries.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing readelf crash entries with signal 6 (SIGABRT) or core dump generation.
• File System: Unexpected core dump files (e.g., core, core.<pid>) in directories where readelf was executed against untrusted ELF files.
• Network: Submission of crafted ELF binaries through automated analysis pipelines or upload endpoints that invoke readelf on user-supplied files.

Update GNU Binutils to a version newer than 2.46 that includes the fix. If an immediate update is not possible, apply the upstream patch from commit ea4bc025abdba85a90e26e13f551c16a44bfa921 in the Binutils-GDB git repository. As a workaround, restrict or disable the use of readelf on untrusted ELF binaries until patching is complete. Fedora has issued an update for mingw-binutils addressing this and related CVEs (Sourceware Patch, Fedora Advisory).

The CVE has attracted some dispute from third parties who argue the vulnerability only manifested in pre-release code and did not affect any officially tagged version of GNU Binutils, which is reflected in the CVE description itself. The Yocto Project security mailing list has tracked this CVE across multiple weekly CVE metrics reports, indicating awareness in embedded Linux communities. Coverage has been limited to automated vulnerability aggregators and security news feeds, with no notable researcher commentary or significant social media discussion observed (Feedly, Yocto Security List).