CVE-2026-90801

A flaw was found in GNU Binutils. A buffer overflow vulnerability exists in the cache_bwrite function within the bfd/cache.c file of the ld component. This flaw can be triggered by manipulating the nbytes argument, allowing a local attacker to potentially cause information disclosure or denial of service.

A flaw was found in GNU Binutils in the cache_bwrite function of bfd/cache.c, used by the ld linker. A local attacker able to supply specially crafted input that manipulates the nbytes argument to ld could trigger a buffer overflow, potentially causing information disclosure or a denial of service (crash of the linker). Red Hat rates this flaw with a CVSS 3.1 base score of 5.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), Moderate impact, while NVD assigns 6.6 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H); the difference reflects NVD's higher availability-impact assessment, though both rate the overall severity as Moderate. Within the Red Hat portfolio, only Red Hat Hardened Images (hummingbird-1, binutils component) is affected, and a fix is being pursued through the delegated resolution process. Red Hat Enterprise Linux, OpenShift Container Platform, and the other covered components and community offerings were evaluated and determined to be not affected because the vulnerable code is not present in the shipped versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.