Re: RFC: Fix for CVE-2026-19548
Project / Subsystem
binutils / archive
Date
2026-08-14
Proposer
"Maciej W. Rozycki" <macro@orcam.me.uk>
Source type
public_inbox
Consensus
Proposed
Sentiment
—/10
Technical tradeoffs
- • Fixes a critical memory leak and potential security vulnerability.
- • Simplifies memory management within the affected function.
All attributes
- project
- binutils
- subsystem
- archive
- patch_id
- —
- discussion_id
- alpine.DEB.2.21.2608141723420.14132@angie.orcam.me.uk
- source_type
- public_inbox
- title
- Re: RFC: Fix for CVE-2026-19548
- headline
- RFC: Fix for CVE-2026-19548
- tldr
- Fixes a memory leak in the archive processing logic that could lead to a crash or denial of service.
- proposer
- "Maciej W. Rozycki" <macro@orcam.me.uk>
- consensus
- Proposed
- outcome
- proposed
- sentiment_score
- —
- technical_tradeoffs
-
- • Fixes a critical memory leak and potential security vulnerability.
- • Simplifies memory management within the affected function.
- series_id
- —
- series_role
- standalone
- series_parts
- []
- tags
-
- • binutils
- • bfd
- • archive
- • memory leak
- • CVE
- bugzilla_url
- —
- date
- 2026-08-14T00:00:00.000Z
Re: RFC: Fix for CVE-2026-19548
This RFC proposes a fix for a memory leak identified in the archive processing logic, specifically related to the _bfd_compute_and_push_armap function. The issue arises from a premature bfd_release call, causing memory allocated for ardata->symdefs to be lost. The proposed solution involves using a local objalloc structure instead of attaching it to the archive BFD.