CVE-2026-91779: 
NixOS vulnerability analysis and mitigation

CVE-2026-91779 is a NULL pointer dereference vulnerability in GNU Binutils 2.47 affecting the _bfd_elf_eh_frame_section_offset function in bfd/elf-eh-frame.c (the Eh Frame Handler component). The flaw was reported to the GNU project via Bugzilla (issue #34446) on 2026-07-28 and publicly disclosed on September 15, 2026; as of the disclosure date, the project had not yet responded or issued a fix. It affects Binutils 2.47 (release tarball dated 20260726) and the dev snapshot at commit 640a79623. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 base score of 1.9 (Low) (GitHub Advisory, CVE Submit).

The root cause is a NULL pointer dereference (CWE-476) in the section-offset query path of the Eh Frame Handler. During a relocatable link (ld -r), the call chain elf_link_input_bfd() → _bfd_elf_section_offset() → _bfd_elf_eh_frame_section_offset() is triggered; a malformed .eh_frame section leaves the CIE/FDE parsing state inconsistent, causing cie_inf (or an equivalent state pointer) to be dereferenced while still NULL, resulting in a read at address 0xa at bfd/elf-eh-frame.c:1840. The attack requires local access and low privileges — an attacker must supply a crafted object file as input to ld. The reporter notes this may be an incomplete fix of related bugs 33478 and 33499, and it is distinct from bug 34445 (a crash in the eh_frame write path). A proof-of-concept object file (bug_9.o) is publicly available (CVE Submit, Bugzilla).

Successful exploitation causes the GNU ld linker process to crash with a segmentation fault, resulting in a denial-of-service condition. There is no impact on confidentiality or integrity — only availability is affected, limited to the scope of the ld process itself. Environments most at risk include toolchains, build systems, or CI/CD pipelines that invoke ld -r on untrusted or user-supplied object files, such as services performing partial links on uploaded artifacts (CVE Submit, GitHub Advisory).

A proof-of-concept object file (bug_9.o) is publicly available via the Bugzilla attachment and the reporter's GitHub repository, demonstrating reproducible crashes under AddressSanitizer. The EPSS score is 0.0, indicating negligible probability of exploitation in the wild, and there is no evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No patch has been released as of the disclosure date (CVE Submit, GitHub Advisory).

1. Prepare the malicious object file: Craft or obtain a malformed ELF object file with an inconsistent .eh_frame section (e.g., the publicly available bug_9.o PoC from the Bugzilla attachment or the reporter's GitHub repository).
2. Identify a vulnerable target: Confirm the target system is running GNU Binutils 2.47 (release tarball dated 20260726) or dev snapshot at commit 640a79623 by running ld --version.
3. Invoke the linker in relocatable mode: Execute ld -r -o /dev/null bug_9.o (or equivalent) to trigger the vulnerable code path through elf_link_input_bfd() → _bfd_elf_section_offset() → _bfd_elf_eh_frame_section_offset().
4. Trigger the NULL dereference: The malformed .eh_frame causes cie_inf to be NULL when dereferenced at bfd/elf-eh-frame.c:1840, crashing the ld process with a SIGSEGV (read at address 0xa).
5. Achieve denial of service: The ld process terminates, disrupting any build, CI pipeline, or service that depends on the linker completing successfully (CVE Submit).

• Process: Unexpected termination of the ld or ld-new process with a segmentation fault (SIGSEGV); crash reports referencing _bfd_elf_eh_frame_section_offset in the stack trace.
• Logs: Build system or CI logs showing ld exiting with a non-zero status and error messages such as SIGSEGV or AddressSanitizer: SEGV on unknown address 0x00000000000a; stack traces referencing bfd/elf-eh-frame.c:1840, bfd/elf.c:13361, bfd/elflink.c:11987, or ld/ldwrite.c:548.
• File System: Presence of unexpected or externally supplied object files (e.g., bug_9.o) in build directories, particularly those with malformed .eh_frame sections (CVE Submit).

No upstream patch has been released by GNU Binutils as of the disclosure date (September 15, 2026), and the Bugzilla issue (#34446) remains unconfirmed. As a workaround, avoid running ld -r directly on untrusted or user-supplied object files. Restrict local access to systems running GNU Binutils 2.47 and limit privileges for users who interact with binutils tools. Monitor the GNU Binutils Bugzilla and official GNU security advisories for patch releases, and upgrade promptly once a fix is available (CVE Submit, GitHub Advisory).