Red Hat CVE-2026-27144

The Go compiler (cmd/compile) performs optimization during code generation, including unwrapping pointer operands for memory move operations to determine whether source and destination regions overlap. This CVE affects the compiler's static analysis phase where a no-op interface conversion-an interface type conversion that should have no runtime effect-prevented correct pointer analysis. The compiler failed to recognize non-overlapping memory regions, potentially emitting incorrect machine code that performs unsafe memory copies. This represents a compiler bug rather than a runtime library vulnerability, meaning the defect exists in the toolchain that builds Go programs. The affected component is specifically the cmd/compile package (CPE: cpe:2.3:a:go_toolchain:cmd/compile), which is the Go compiler binary itself. While no CWE is assigned, this aligns with compiler optimization errors that can introduce undefined behavior into compiled outputs.