CVE-2026-6844: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-6844 is a pair of Denial of Service (DoS) vulnerabilities in the readelf utility of the GNU binutils package. A local attacker can exploit these flaws by supplying a specially crafted Executable and Linkable Format (ELF) file, triggering either uncontrolled resource consumption (CWE-400) leading to an out-of-memory condition, or a null pointer dereference (CWE-476) causing a segmentation fault. Affected software includes GNU binutils (all versions, with specific confirmed impact on 2.46) and Red Hat Enterprise Linux 7.0–10.0, Red Hat OpenShift Container Platform 4.0, and Red Hat Hardened Images. The vulnerability was disclosed on April 22, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The vulnerability has two distinct root causes within readelf version 2.46: (1) a resource exhaustion flaw (CWE-400) where a malformed ELF file can trigger an allocation of approximately 6.3 TB of memory, resulting in an OOM kill; and (2) a null pointer dereference (CWE-476) caused by malformed sh_entsize or shoff fields in the ELF section header, leading to a SIGSEGV. Both issues were discovered through AFL++ fuzzing, and proof-of-concept ELF files were attached to the internal JSM ticket but have not been publicly disclosed. Exploitation requires a local attacker to provide a crafted ELF file to a user or automated process running readelf (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation results in a denial of service affecting the readelf utility — either through an unresponsive process due to memory exhaustion or an immediate crash via segmentation fault. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H). Automated binary analysis pipelines, build systems, or security tooling that invoke readelf on untrusted ELF files are at elevated risk of disruption (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed. The vulnerability was discovered via AFL++ fuzzing, with PoC ELF files held privately in the Red Hat internal ticket system. The EPSS score is approximately 0.013%–0.019%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat Bugzilla).

1. Craft a malicious ELF file: Create a specially crafted ELF binary with either an excessively large allocation hint (e.g., manipulated sh_size or similar fields to trigger ~6.3 TB allocation) or malformed sh_entsize/shoff section header fields to induce a null pointer dereference.
2. Deliver the file to the target: Place the crafted ELF file in a location accessible to the target user or automated pipeline (e.g., upload to a build server, shared directory, or CI/CD artifact store).
3. Trigger readelf execution: Cause the target system to invoke readelf on the malicious file — either by social engineering a user to run readelf -a malicious.elf, or by exploiting an automated analysis workflow that processes untrusted binaries.
4. Achieve denial of service: The resource exhaustion variant causes the system to attempt a massive memory allocation, triggering an OOM kill and crashing readelf (and potentially impacting system stability). The null pointer dereference variant causes an immediate SIGSEGV, crashing the readelf process (Red Hat Bugzilla).

• File System: Presence of anomalous or unexpected ELF files with unusually large section size fields or malformed section headers in directories processed by automated analysis tools.
• Logs: System OOM killer log entries (kernel: Out of memory: Kill process) referencing the readelf process; crash reports or core dumps from readelf with SIGSEGV signals.
• Process: readelf processes consuming abnormally high memory (approaching system RAM limits) before termination; unexpected readelf process crashes in automated pipelines.
• System: Repeated OOM events or system instability coinciding with ELF file processing workflows (Red Hat Bugzilla).

Patches are available for this vulnerability — apply the latest security updates to the binutils package on affected Red Hat Enterprise Linux (7.0, 8.0, 9.0, 10.0), OpenShift Container Platform 4.0, and Hardened Images systems. As a workaround, restrict access to the readelf utility and avoid processing untrusted ELF files with it, particularly in automated pipelines. Consider sandboxing readelf operations (e.g., using containers or seccomp profiles) and implementing input validation before passing ELF files to analysis tools (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received routine automated coverage across CVE tracking platforms and security feeds shortly after disclosure on April 22, 2026. The Yocto Project security mailing list discussed the CVE in the context of OE-Core CVE metrics in May–June 2026, indicating awareness in the embedded Linux community. No notable researcher commentary, vendor statements beyond Red Hat's advisory, or significant media coverage has been identified (Yocto Security List).