Repository navigation
cmd/compile: no-op interface conversion bypasses overlap checking #78371
Description
Activity
@gopherbot please open backport issues for this security fix
Backport issue(s) opened: #78423 (for 1.25), #78424 (for 1.26).
Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.
Change https://go.dev/cl/763545 mentions this issue:
[release-branch.go1.26] cmd/compile: fix mem access overlap detectionChange https://go.dev/cl/763552 mentions this issue:
[release-branch.go1.25] cmd/compile: fix mem access overlap detection- changed the title
[-]security: fix CVE-2026-27144[/-][+]cmd/compile: no-op interface conversion bypasses overlap checking[/+]on Apr 7, 2026 Change https://go.dev/cl/763764 mentions this issue:
cmd/compile: fix mem access overlap detection- added a commit that references this issue
on Apr 8, 2026
Previously, the compiler failed to unwrap pointers contained within
a no-op interface conversion leading to an incorrect determination
of a non-overlapping move.
To prevent unsafe move operations, the compiler will now unwrap all
such conversions before considering a move non-overlapping.
Thank you to Jakub Ciolek - https://ciolek.dev/ for reporting this issue.
This is CVE-2026-27144 and Go issue https://go.dev/issue/78371.
This is a PRIVATE issue for CVE-2026-27144, tracked in http://b/490151411 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3780.
/cc @golang/security and @golang/release