CVE-2026-90802

A flaw was found in GNU Binutils. A local attacker can exploit a null pointer dereference vulnerability in the bfd_putl64 function of the ld component. This can lead to a denial of service or application instability.

This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires local access and user interaction to process an untrusted, malformed object file through the linker. Because the GNU linker operates as a short-lived command-line utility rather than an exposed background service, the blast radius of a crash is restricted entirely to the immediate linking task. The flaw does not facilitate arbitrary code execution, privilege escalation, or compromise of system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.