CVE-2026-64615: Perl Data::Graph::Shared Disclosure Flaw

CVE-2026-64615 Overview

CVE-2026-64615 affects Data::Graph::Shared versions before 0.04 for Perl. The module creates a world-readable memory-mapped backing file used for inter-process communication (IPC). The file is opened without the O_EXCL or O_NOFOLLOW flags, exposing the shared segment to local attackers.

Because the segment typically lives in a shared directory such as /tmp or /dev/shm, any local user can read the IPC payloads. A pre-planted file or symlink at the target path lets a local attacker win a pre-creation race or redirect the open operation to an attacker-controlled location.

Critical Impact
Local users can read shared IPC data or redirect file creation through symlink attacks against processes using Data::Graph::Shared before version 0.04.

Affected Products

Data::Graph::Shared Perl module versions prior to 0.04
Applications embedding the vulnerable graph.h shared segment logic
Linux and Unix-like systems where the module is installed

Discovery Timeline

2026-07-21 - CVE-2026-64615 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64615

Vulnerability Analysis

The vulnerability is a file system flaw classified under [CWE-59] (Improper Link Resolution Before File Access, also known as a symlink following issue). The Data::Graph::Shared module allocates a shared memory segment backed by a file on disk. This backing file is used to store IPC payloads that multiple processes read and write concurrently.

The module creates the segment in graph.h using the call open(path, O_RDWR|O_CREAT, 0666). Two problems arise from this single call. First, the mode argument 0666 combined with the default umask 022 produces a file with permissions 0644, making the IPC payload readable by every local user on the system. Second, the omission of O_NOFOLLOW and O_EXCL flags allows the open syscall to follow symlinks and to silently reuse an existing file rather than failing.

Root Cause

The root cause is unsafe file creation semantics in shared-directory contexts. O_NOFOLLOW would cause the open call to fail if the final path component is a symlink, preventing redirection attacks. O_EXCL combined with O_CREAT would cause the call to fail if the file already exists, preventing a local attacker from planting a file at the expected path before the victim process runs.

Attack Vector

A local attacker with unprivileged access first identifies the predictable path used by Data::Graph::Shared in a shared directory such as /tmp or /dev/shm. The attacker then plants either a regular file or a symlink at that path before the victim process starts. When the victim opens the segment, the syscall either follows the symlink to an attacker-chosen destination or reuses the pre-planted file. Separately, any local user can simply read the world-readable segment during normal operation to harvest IPC contents.

No verified public exploit code is available. See the MetaCPAN Release Diff Comparison for the upstream code change addressing the flaw.

Detection Methods for CVE-2026-64615

Indicators of Compromise

Unexpected symlinks in /tmp or /dev/shm pointing to sensitive files owned by other users
Pre-existing files at paths used by Data::Graph::Shared before the consuming process starts
World-readable mmap backing files (mode 0644) in shared IPC directories

Detection Strategies

Audit installed Perl modules for Data::Graph::Shared versions below 0.04 using cpan -l or package inventory tools
Inspect shared directories for files created with permissive modes by processes that handle sensitive IPC data
Monitor open syscalls against predictable paths in /tmp and /dev/shm using auditd or eBPF instrumentation

Monitoring Recommendations

Enable Linux audit rules on /tmp and /dev/shm file creation events for processes running Perl interpreters
Alert on symlink creation in world-writable directories that targets files owned by service accounts
Track file permission changes on IPC backing files to detect unexpected world-readable states

How to Mitigate CVE-2026-64615

Immediate Actions Required

Upgrade Data::Graph::Shared to version 0.04 or later on all affected systems
Identify any application that consumes the module and restart it after patching to release open file descriptors
Review shared directories for stale backing files created by vulnerable versions and remove them

Patch Information

The fix landed in Data::Graph::Shared version 0.04. The updated graph.h opens the backing file with O_EXCL and O_NOFOLLOW, and the file is created with restrictive permissions. Details of the change are documented in the MetaCPAN Release Changes and the MetaCPAN Release Diff Comparison.

Workarounds

Configure the consuming application to place backing files in a private directory such as a per-user runtime directory rather than /tmp or /dev/shm
Set a restrictive umask (for example 0077) for the process before it creates the segment so the file is not world-readable
Restrict shell access on multi-tenant hosts to reduce the population of local attackers able to exploit the flaw

bash

# Configuration example: run the consumer with a restrictive umask
# and a private runtime directory
export TMPDIR="/run/user/$(id -u)/graph-shared"
mkdir -p "$TMPDIR"
chmod 700 "$TMPDIR"
umask 0077
perl your_application.pl