CVE-2026-4647: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-4647 is an out-of-bounds read vulnerability in the GNU Binutils BFD (Binary File Descriptor) library, specifically affecting XCOFF relocation processing. The flaw exists in the xcoff_ppc_relocate_section() and xcoff64_ppc_relocate_section() functions in coff-rs6000.c and coff64-rs6000.c, where the relocation type field (r_type) is used as an array index without adequate bounds checking. It affects all versions of GNU Binutils prior to 2.47, as well as Red Hat Enterprise Linux 6.0–10.0 and OpenShift Container Platform 4.0. The vulnerability was published on March 23, 2026, with a CVSS v3.1 base score of 6.1 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-125 (Out-of-bounds Read). The r_type field is read directly from a specially crafted XCOFF object file and used as an array index in the relocation processing functions without proper validation of its bounds, allowing memory outside the intended buffer to be accessed (Red Hat Bugzilla). The attack vector is local (AV:L), requires no privileges (PR:N), but does require user interaction (UI:R) — specifically, a user or automated tool must process the malicious XCOFF file using a vulnerable binutils tool such as objdump, ld, or readelf. The upstream bug is tracked at Sourceware Bugzilla.

Successful exploitation can cause affected binutils tools to crash (denial of service) or expose unintended memory contents (limited information disclosure). The confidentiality impact is low and integrity is unaffected, but availability impact is rated high due to the potential for application crashes. The attack is constrained to local access and requires user interaction, limiting its scope, but automated build pipelines or developer toolchains that process untrusted binary files could be affected without direct user awareness (Red Hat CVE, Red Hat Bugzilla).

1. Craft malicious XCOFF file: Create a specially crafted XCOFF object file with an invalid or out-of-range r_type relocation type field value in the relocation table entries of coff-rs6000.c or coff64-rs6000.c structures.
2. Deliver the file: Place the malicious XCOFF file in a location where a target user or automated build system will process it — for example, as a dependency in a build pipeline, a shared repository, or via social engineering.
3. Trigger processing: Wait for or induce the target to process the file using a vulnerable GNU Binutils tool (e.g., objdump -r malicious.o, ld malicious.o, or readelf) on a system running GNU Binutils prior to version 2.47.
4. Achieve impact: The unvalidated r_type value is used as an array index, causing an out-of-bounds memory read. This results in either a crash (DoS) of the binutils tool or potential exposure of adjacent memory contents to the attacker (Red Hat Bugzilla).

• Process: Unexpected crashes or segmentation faults in binutils tools (objdump, ld, readelf, nm) when processing XCOFF object files.
• Logs: Core dump files generated by binutils processes; system logs (e.g., /var/log/messages, journalctl) showing segfault entries for binutils executables.
• File System: Presence of unexpected or externally sourced XCOFF object files (.o files with XCOFF magic numbers 0x01DF or 0x01EF) in build directories or temporary folders.
• Network: In automated CI/CD environments, unexpected build failures or tool exits with non-zero status codes when processing binary artifacts from external sources.

Upgrade GNU Binutils to version 2.47 or later, which includes the fix for improper bounds checking on the r_type field (Red Hat Bugzilla). Red Hat has released updated packages for affected RHEL versions (6.0, 7.0, 8.0, 9.0, 10.0) and OpenShift Container Platform 4.0; apply the relevant vendor errata as soon as available (Red Hat CVE). Microsoft has also released updates for Azure Linux 3 (AZL3) binutils packages (Microsoft MSRC). As a workaround, restrict processing of untrusted or externally sourced XCOFF object files, and limit user access to binutils tools where feasible.

The vulnerability received routine coverage from Linux security news aggregators and distribution security lists, including Fedora and Yocto Project security mailing lists, following the release of updated packages (Yocto Security List). Pro-Linux.de and LinuxSecurity.com published advisories noting the information disclosure risk in binutils/insight packages for Fedora. No notable researcher commentary or significant social media discussion beyond automated CVE tracking posts has been observed.