CVE-2026-64616: Perl Data::NDArray::Shared Vulnerability

CVE-2026-64616 Overview

CVE-2026-64616 affects the Data::NDArray::Shared Perl module in versions before 0.02. The module creates a world-readable memory-mapped backing file for its shared IPC segments and opens that file without the O_EXCL or O_NOFOLLOW flags. Any local user on the system can read the shared segment payloads, and an attacker can pre-plant a file or symlink at the target path to hijack the open. The flaw is classified under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Local attackers can read shared IPC data from a world-readable mmap segment or redirect the open via a symlink planted in /tmp or /dev/shm.

Affected Products

Data::NDArray::Shared Perl module versions prior to 0.02
Applications on Linux hosts that depend on the affected module for shared-memory ndarrays
Multi-user systems that place shared segments in world-writable directories such as /tmp or /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-64616 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-64616

Vulnerability Analysis

The Data::NDArray::Shared module allocates shared memory by creating a backing file on disk and mapping it with mmap. The vulnerable code in ndarray.h calls open(path, O_RDWR|O_CREAT, 0666). Two independent problems compound in this single call.

First, the file mode is 0666. With the default umask of 022, the resulting file is created with mode 0644, making it world-readable. Any local user can open the backing file and read every value the module writes into the shared segment, including inter-process communication payloads that the application treats as private.

Second, the open omits both O_NOFOLLOW and O_EXCL. Without O_NOFOLLOW, a symlink planted at the target path is silently followed. Without O_EXCL, a pre-existing file at the path is reused rather than causing the open to fail. Together these flags would have made pre-creation attacks detectable.

Root Cause

The root cause is insecure file creation semantics in a shared IPC primitive. The module assumes the backing file location is trusted, but it places that file in a directory reachable by other local users. Combining a permissive creation mode with the absence of O_EXCL and O_NOFOLLOW turns a routine open into a symlink-following, race-prone operation.

Attack Vector

A local unprivileged attacker predicts or observes the backing file path used by a victim process in a shared directory such as /tmp or /dev/shm. Two attack shapes follow.

In the passive case, the attacker waits for the victim to create the segment, then reads the world-readable file directly to exfiltrate ndarray contents. In the active case, the attacker wins a pre-creation race by placing either a regular file or a symlink at the predicted path. When the victim opens the path, the process either reuses the attacker-controlled file or follows the symlink to a target chosen by the attacker, subject to the victim's own file permissions.

No verified public exploit code has been published. Technical details of the fix are documented in the MetaCPAN Release Diff and MetaCPAN Release Changes.

Detection Methods for CVE-2026-64616

Indicators of Compromise

Files created by processes using Data::NDArray::Shared in /tmp, /dev/shm, or other world-accessible directories with mode 0644 or more permissive.
Symlinks in shared directories whose target paths match locations expected to be written by an application using the affected module.
Backing files owned by an unexpected user identifier relative to the process that mapped them.

Detection Strategies

Audit installed Perl distributions on Linux hosts for Data::NDArray::Shared versions below 0.02 using cpanm --info or by inspecting perllocal.pod.
Scan for world-readable regular files in /tmp and /dev/shm that are actively mmaped by long-running processes, using lsof combined with a stat check on file mode bits.
Trace open and openat syscalls from Perl interpreters with auditd or eBPF tooling and flag calls that target shared directories without O_NOFOLLOW or O_EXCL.

Monitoring Recommendations

Alert on symlink creation events in /tmp and /dev/shm whose targets resolve outside those directories.
Log process ancestry and command lines for any Perl process that maps files from world-writable directories.
Track file-mode changes on IPC backing files and correlate with the creating process to detect pre-planted artifacts.

How to Mitigate CVE-2026-64616

Immediate Actions Required

Upgrade Data::NDArray::Shared to version 0.02 or later on every host that has the module installed.
Identify running processes that hold mmap mappings backed by files in /tmp or /dev/shm and restart them after the upgrade.
Remove any stale backing files left by earlier vulnerable versions to prevent reuse by the patched code.

Patch Information

The maintainer released Data-NDArray-Shared-0.02, which corrects the file creation logic in ndarray.h. Consult the MetaCPAN Release Changes for the changelog and the MetaCPAN Release Diff for the source-level fix. Rebuild or reinstall the XS component after upgrading so the compiled ndarray.h changes take effect.

Workarounds

Relocate the backing file to a per-user directory that is not writable by other local users, such as a subdirectory of $HOME with mode 0700.
Tighten the running process umask to 077 so newly created files inherit non-world-readable modes until the upgrade is applied.
Restrict access to /tmp and /dev/shm using the fs.protected_symlinks=1 and fs.protected_regular=1 kernel sysctls to reduce symlink and hardlink attack surface.

bash

# Configuration example
# Upgrade the affected module from CPAN
cpanm Data::NDArray::Shared~'>=0.02'

# Harden shared directories against pre-planting attacks
sysctl -w fs.protected_symlinks=1
sysctl -w fs.protected_regular=1
sysctl -w fs.protected_hardlinks=1

# Enforce a restrictive umask for services using the module
umask 077