onnxruntime: cannot enable executable stack as shared object requires (fix)

import onnxruntime fails with cannot enable executable stack as shared object requires: Invalid argument on new Linux distros. We reproduced it with onnxruntime 1.16.3 on Debian 13, found which versions carry the flag, and tested three fixes.

1. The error

import onnxruntime as ort
print("onnxruntime", ort.__version__)
print(ort.get_available_providers())

onnxruntime 1.16.3 on Debian 13 (glibc 2.41):

Traceback (most recent call last):
  File "b1.py", line 1, in <module>
    import onnxruntime as ort
  File ".../site-packages/onnxruntime/__init__.py", line 56, in <module>
    raise import_capi_exception
  File ".../site-packages/onnxruntime/__init__.py", line 23, in <module>
    from onnxruntime.capi._pybind_state import ExecutionMode  # noqa: F401
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File ".../site-packages/onnxruntime/capi/_pybind_state.py", line 32, in <module>
    from .onnxruntime_pybind11_state import *  # noqa
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
ImportError: .../site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so: cannot enable executable stack as shared object requires: Invalid argument

The compiled module onnxruntime_pybind11_state is marked as needing an executable stack, and glibc 2.41 no longer lets dlopen enable one, so the import fails. Same cause as the torch version of this error.

2. Which versions have the flag

We installed the CPU wheels for CPython 3.11 and scanned their .so files with this stdlib-only script:

import glob, os, struct, sys

PT_GNU_STACK = 0x6474E551
PF_X = 1

def needs_execstack(path):
    with open(path, "rb") as f:
        hdr = f.read(64)
        if hdr[:4] != b"\x7fELF" or hdr[4] != 2:  # 64-bit ELF only
            return None
        phoff, = struct.unpack_from("<Q", hdr, 0x20)
        phentsize, phnum = struct.unpack_from("<HH", hdr, 0x36)
        for i in range(phnum):
            f.seek(phoff + i * phentsize)
            p_type, p_flags = struct.unpack("<II", f.read(8))
            if p_type == PT_GNU_STACK:
                return bool(p_flags & PF_X)
    return None

root = sys.argv[1]
for so in sorted(glob.glob(os.path.join(root, "**", "*.so*"), recursive=True)):
    if needs_execstack(so):
        print("needs executable stack:", os.path.relpath(so, root))
print("scan done")

1.16.3 (1.15.1 and 1.16.0 give the same):

needs executable stack: capi/onnxruntime_pybind11_state.cpython-311-x86_64-linux-gnu.so
scan done

1.17.3, 1.19.2, 1.20.1 and 1.21.0 print only scan done. Point the script at any package directory to check other wheels (GPU builds, other Python versions) yourself.

3. Fix A: upgrade onnxruntime

onnxruntime 1.17.3 imports normally on the same system:

onnxruntime 1.17.3
['AzureExecutionProvider', 'CPUExecutionProvider']

If a library pins onnxruntime<1.17, try B or C.

4. Fix B: clear the flag with patchelf (no root)

After pip install patchelf:

SP=$(python -c "import sysconfig; print(sysconfig.get_paths()['purelib'])")
patchelf --clear-execstack "$SP"/onnxruntime/capi/onnxruntime_pybind11_state*.so
echo "patched"

patched

scan done

onnxruntime 1.16.3
['AzureExecutionProvider', 'CPUExecutionProvider']

Reinstalling onnxruntime restores the flag, so re-run the patch after each reinstall.

5. Fix C: the glibc tunable

With the unpatched file:

GLIBC_TUNABLES=glibc.rtld.execstack=2 python b1.py

onnxruntime 1.16.3
['AzureExecutionProvider', 'CPUExecutionProvider']

This worked on Debian's glibc 2.41. It re-allows executable stacks for the whole process, so use it to confirm the diagnosis and prefer A or B.

Related: cannot enable executable stack (torch, any library) · torch: No module named pkg_resources

Written with AI assistance. Measured on 2026-10-24 on Debian 13 (glibc 2.41-12+deb13u4), CPython 3.11.17: onnxruntime 1.15.1, 1.16.0, 1.16.3, 1.17.3, 1.19.2, 1.20.1, 1.21.0 (CPU wheels), patchelf 0.19.1. Output pasted unedited except shortened paths. PlainTables is our extension; onnxruntime and patchelf are free.