CVE-2026-64613: Data::Buffer::Shared Information Disclosure

CVE-2026-64613 Overview

CVE-2026-64613 affects the Perl module Data::Buffer::Shared in versions before 0.05. The module creates a memory-mapped (mmap) backing file with world-readable permissions and opens it without the O_NOFOLLOW flag. Because shared segments typically reside in world-writable directories such as /tmp or /dev/shm, any local user can read the inter-process communication (IPC) payloads stored in the segment. A pre-planted symlink at the target path also redirects the open operation to an attacker-chosen file, enabling symlink attacks [CWE-59].

Critical Impact
Local attackers can read sensitive IPC data stored in shared memory segments and redirect file operations through symlink attacks in shared directories.

Affected Products

Data::Buffer::Shared Perl module versions prior to 0.05
Applications using Data::Buffer::Shared for IPC on Unix-like systems
Systems where the module writes segments to shared directories such as /tmp or /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-64613 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64613

Vulnerability Analysis

The vulnerability originates in buf_generic.h within the Data::Buffer::Shared module. The segment creation call uses open(path, O_RDWR|O_CREAT|O_EXCL, 0666). Two distinct weaknesses exist in this call.

First, the mode argument 0666 combined with the default umask of 022 results in file permissions of 0644. This makes the backing file world-readable. Any local user on the system can read IPC payloads that transit the shared segment, including credentials, tokens, or application state.

Second, the open call omits O_NOFOLLOW. When the target path exists as a symlink, the kernel follows the link. An attacker who pre-plants a symlink at the predictable path in /tmp or /dev/shm can redirect the open to an arbitrary file the process has permission to write.

Root Cause

The root cause is unsafe file creation semantics in a shared directory. The O_EXCL flag prevents opening an existing regular file, but does not defend against symlinks in the same atomic operation without O_NOFOLLOW. The overly permissive 0666 mode compounds the issue by exposing segment contents to any local account.

Attack Vector

Exploitation requires local access. An attacker with a shell on the host monitors the shared directory for the predictable segment path. The attacker either reads the world-readable segment directly to harvest IPC data or plants a symlink at the anticipated path before the victim process starts, causing the victim to operate on an attacker-controlled target. See the MetaCPAN release diff for the corrected open flags and mode.

Detection Methods for CVE-2026-64613

Indicators of Compromise

Unexpected symlinks in /tmp or /dev/shm pointing to sensitive files owned by the Perl process user
World-readable files in shared directories with names matching Data::Buffer::Shared segment paths
Read access to shared segment files by user accounts unrelated to the owning application

Detection Strategies

Audit installed Perl module versions and flag any Data::Buffer::Shared release below 0.05
Use file integrity monitoring on /tmp and /dev/shm to detect symlink creation targeting known segment names
Enable Linux audit rules on open and openat syscalls against shared directories to record the effective UID and target inode

Monitoring Recommendations

Log processes that create files with mode 0644 or broader in /tmp and /dev/shm
Alert on readlink or lstat activity by non-owner users against IPC segment paths
Track Perl process invocations that load Data::Buffer::Shared and correlate with segment file creation events

How to Mitigate CVE-2026-64613

Immediate Actions Required

Upgrade Data::Buffer::Shared to version 0.05 or later on all systems using the module
Inventory Perl applications that depend on the module and schedule redeployment after the upgrade
Rotate any secrets or tokens that may have been transmitted through shared segments on multi-user hosts

Patch Information

Version 0.05 of Data::Buffer::Shared corrects the open call in buf_generic.h to use restrictive permissions and adds O_NOFOLLOW to reject symlink targets. Review the MetaCPAN release changes for the full changelog.

Workarounds

Configure the application to place segments in a directory with mode 0700 owned by the application user, rather than /tmp or /dev/shm
Enforce a stricter process umask such as 077 before invoking code that uses Data::Buffer::Shared
Restrict local shell access on hosts running affected Perl applications until the module is upgraded

bash

# Configuration example
umask 077
cpanm Data::Buffer::Shared@0.05