CVE-2026-64617: Perl Data::PubSub::Shared Disclosure Flaw

CVE-2026-64617 Overview

CVE-2026-64617 affects Data::PubSub::Shared versions before 0.07 for Perl. The module creates a world-readable memory-mapped (mmap) backing file used for inter-process communication (IPC). The file is opened without the O_EXCL or O_NOFOLLOW flags, allowing symlink-following and pre-planted file substitution. Because the segment lives in shared directories such as /tmp or /dev/shm, any local user can read IPC payloads written to the world-readable file. This is a local-only issue classified under [CWE-59] (Link Following).

Critical Impact
Local users can read shared IPC payloads or redirect the mmap backing file via symlink attacks against Data::PubSub::Shared before version 0.07.

Affected Products

Data::PubSub::Shared Perl module, all versions prior to 0.07
Systems using this module for shared-memory IPC in world-writable directories (/tmp, /dev/shm)
Multi-user Linux and Unix hosts running Perl applications that depend on the module

Discovery Timeline

2026-07-21 - CVE-2026-64617 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64617

Vulnerability Analysis

The defect lives in pubsub.h, where the shared segment is created with open(path, O_RDWR|O_CREAT, 0666). The mode argument is 0666. Under the default umask of 022, the resulting file is created with mode 0644, making it world-readable. Any local account on the host can therefore read the mmap-backed IPC payloads exchanged through the module.

The same open() call omits O_NOFOLLOW, so a symlink planted at the target path is followed to an attacker-chosen destination. It also omits O_EXCL, so if a file already exists at the path the open succeeds silently instead of failing. The result is a link-following flaw combined with a pre-creation race window.

Root Cause

The root cause is unsafe file creation semantics in a shared directory. The code trusts the pathname within /tmp or /dev/shm without verifying that the file does not already exist and without refusing symlinks. Additionally, the permission mode 0666 grants read access to all local users, which is inappropriate for IPC content that may be sensitive.

Attack Vector

A local unprivileged attacker performs one of two actions. First, they read the world-readable segment directly to capture IPC data written by the victim process. Second, they place a symlink or file at the expected path before the victim process runs, redirecting the open() call or forcing the victim to write into an attacker-controlled file. Exploitation requires local access and low privileges. No user interaction is needed.

No verified public exploit code is available. Refer to the MetaCPAN Release Diff for the exact source-level changes that address the issue.

Detection Methods for CVE-2026-64617

Indicators of Compromise

Presence of world-readable files (mode 0644 or 0666) created by Perl processes in /tmp or /dev/shm with names matching Data::PubSub::Shared segment paths
Symbolic links planted at predictable IPC pathnames by non-privileged users
Unexpected file ownership on segment files where the owner does not match the invoking service account

Detection Strategies

Audit installed Perl modules with cpan -l or corelist and flag any Data::PubSub::Shared version below 0.07
Monitor open() and openat() syscalls with auditd or eBPF for creations in /tmp and /dev/shm lacking O_EXCL or O_NOFOLLOW
Scan filesystems for world-readable IPC artifacts created by production service accounts

Monitoring Recommendations

Enable auditd rules on /tmp and /dev/shm to log file creations and symlink resolutions during service startup
Alert on any local process creating files with mode 0666 in shared temporary directories
Track version drift of Perl CPAN dependencies through software composition analysis tooling

How to Mitigate CVE-2026-64617

Immediate Actions Required

Upgrade Data::PubSub::Shared to version 0.07 or later on every host where the module is installed
Restrict access to shared temporary directories using fs.protected_symlinks=1 and fs.protected_regular=1 sysctl settings
Move IPC backing files out of /tmp and /dev/shm into a directory owned by the service account with mode 0700

Patch Information

The upstream fix ships in Data::PubSub::Shared version 0.07. Details of the code change are documented in the MetaCPAN Release Changes and the source-level MetaCPAN Release Diff. The fix adds O_EXCL and O_NOFOLLOW to the open() call and tightens the creation mode.

Workarounds

Set a restrictive umask such as 0077 for the process invoking the module so the backing file is not world-readable
Place the mmap segment in a per-user or per-service directory with mode 0700 instead of a shared temporary directory
Pre-create the backing file with correct ownership and permissions before starting the service to remove the race window

bash

# Configuration example: run the Perl service with a restrictive umask
# and dedicate a private directory for IPC segments.
install -d -m 0700 -o svcuser -g svcuser /var/run/pubsub-shared
umask 0077
exec sudo -u svcuser env PUBSUB_SHARED_DIR=/var/run/pubsub-shared \
    perl /opt/app/bin/service.pl