CVE-2026-64614: Perl Data::Deque::Shared Info Disclosure

CVE-2026-64614 Overview

CVE-2026-64614 affects Data::Deque::Shared versions before 0.06 for Perl. The module creates a world-readable memory-mapped (mmap) backing file for inter-process communication (IPC). It opens the file without the O_EXCL or O_NOFOLLOW flags, exposing shared data to local users and enabling symlink-based redirection [CWE-59].

The backing segment lives in a shared directory such as /tmp or /dev/shm, where any local account can read the IPC payload. A pre-planted file or symlink at the target path allows a local attacker to redirect the open call or win a pre-creation race.

Critical Impact
Local users can read IPC data from world-readable shared segments or redirect the backing file through symlink attacks against processes using vulnerable versions of Data::Deque::Shared.

Affected Products

Data::Deque::Shared Perl module versions prior to 0.06
Applications that consume Data::Deque::Shared for shared-memory IPC
Linux and Unix-like systems with shared directories such as /tmp and /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-64614 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64614

Vulnerability Analysis

The defect resides in deque.h, which calls open(path, O_RDWR|O_CREAT, 0666) to create the shared mmap backing file. The mode argument is 0666, so with the default umask of 022 the resulting file permissions become 0644. Any local user on the system can read the IPC payload written into the segment.

The missing O_NOFOLLOW flag causes open to follow a symlink planted at the path. The missing O_EXCL flag causes the call to reuse a pre-existing file instead of failing. Together, these omissions turn a routine IPC setup into a symlink-following file creation primitive.

Information exposure and integrity risk both increase because a "Shared" segment is expected to live in a world-writable directory such as /tmp or /dev/shm. The attack requires local access and low privileges, but no user interaction.

Root Cause

The root cause is unsafe file creation semantics [CWE-59]. The module trusts the target path in a shared directory without enforcing exclusive creation or refusing symlinks. It also uses a permissive mode that grants read access to all users after umask filtering.

Attack Vector

A local attacker plants a symlink or file at the predictable backing-file path before the victim process starts. When the vulnerable Perl process calls open, it follows the symlink or opens the pre-existing file, giving the attacker control over the mapped region. Alternatively, the attacker simply reads the world-readable segment after creation to harvest IPC contents.

No verified public exploit code is available. See the MetaCPAN Release Diff for the exact source-level change addressing the flaw.

Detection Methods for CVE-2026-64614

Indicators of Compromise

Symlinks in /tmp or /dev/shm pointing to files owned by other users and matching Data::Deque::Shared naming patterns.
Backing files in shared directories with mode 0644 or broader that contain serialized deque payloads.
Unexpected processes reading shared segment files that belong to another user's Perl process.

Detection Strategies

Audit installed Perl module versions and flag any Data::Deque::Shared release below 0.06.
Monitor open and openat syscalls targeting /tmp and /dev/shm for calls that omit O_EXCL and O_NOFOLLOW when creating shared files.
Alert on symlink creation in world-writable directories where the link target matches paths used by Perl IPC modules.

Monitoring Recommendations

Enable Linux audit rules on /tmp, /var/tmp, and /dev/shm for file creation and symlink events.
Track processes that open files created by other users in shared directories, correlating UID and file owner mismatches.
Review file permissions on IPC backing files during routine host hygiene scans and flag world-readable IPC artifacts.

How to Mitigate CVE-2026-64614

Immediate Actions Required

Upgrade Data::Deque::Shared to version 0.06 or later on all systems running Perl workloads.
Inventory applications that depend on the module and restart them after upgrading to release existing world-readable segments.
Restrict local access to hosts running affected Perl services until the upgrade is complete.

Patch Information

The fix is included in Data::Deque::Shared version 0.06. See the MetaCPAN Release Changes and the MetaCPAN Release Diff for the corrected open invocation in deque.h.

Workarounds

Place shared segment files in a directory owned by the service account with mode 0700 instead of /tmp or /dev/shm.
Tighten the process umask to 077 before invoking the module so that created files are not world-readable.
Use filesystem namespaces or per-user tmpfs mounts to isolate IPC artifacts from other local users.

bash

# Tighten umask before running vulnerable Perl workloads
umask 077

# Verify installed module version
perl -MData::Deque::Shared -e 'print $Data::Deque::Shared::VERSION, "\n"'

# Upgrade to the fixed release
cpanm Data::Deque::Shared@0.06