CVE-2026-65062: Perl SortedSet Information Disclosure Flaw

CVE-2026-65062 Overview

CVE-2026-65062 affects the Data::SortedSet::Shared Perl module in versions before 0.03. The module creates a world-readable memory-mapped backing file without the O_EXCL or O_NOFOLLOW flags. Because shared segments typically reside in world-writable directories such as /tmp or /dev/shm, any local user can read inter-process communication (IPC) payloads. A local attacker can also pre-plant a file or symlink at the target path to win a pre-creation race or redirect the open() call. The issue is classified under [CWE-59] (Link Following).

Critical Impact
Local users can read sensitive IPC data stored in the shared segment and can leverage symlink attacks to redirect the backing-file open operation.

Affected Products

Data::SortedSet::Shared for Perl versions prior to 0.03
Applications embedding the vulnerable module on multi-user Linux systems
Deployments using /tmp or /dev/shm for shared-segment storage

Discovery Timeline

2026-07-21 - CVE-2026-65062 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65062

Vulnerability Analysis

The vulnerability resides in sortedset.h, where the module opens its shared memory-mapped backing file with open(path, O_RDWR|O_CREAT, 0666). The mode 0666 combined with the common default umask of 022 produces a file with mode 0644, making the segment world-readable. Any unprivileged local account on the same host can therefore read the IPC payloads written by processes using the module.

The call also omits O_NOFOLLOW, so a symbolic link planted at the target path is silently followed. The absence of O_EXCL means that a pre-existing file at the path is reused rather than causing the open to fail. Together, these omissions turn a routine IPC bootstrap into a link-following primitive on a predictable path.

Root Cause

The root cause is unsafe file creation semantics for a resource placed in a shared directory. Choosing mode 0666, relying on umask for protection, and omitting O_EXCL and O_NOFOLLOW violates standard secure-file-creation guidance for world-writable locations.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker who can predict or observe the segment path in /tmp or /dev/shm can either read the world-readable segment directly or pre-plant a symlink to redirect the victim process's open() to an attacker-chosen file. See the MetaCPAN Release Diff for the exact code changes that address these flag omissions.

Detection Methods for CVE-2026-65062

Indicators of Compromise

World-readable files (mode 0644 or broader) owned by service accounts in /tmp or /dev/shm matching Data::SortedSet::Shared naming patterns.
Symbolic links planted in shared directories that resolve to sensitive files outside those directories.
Unexpected processes reading shared-segment paths belonging to other users.

Detection Strategies

Inventory installed Perl modules and flag hosts with Data::SortedSet::Shared earlier than 0.03.
Audit /tmp and /dev/shm for files created by long-running services with world-readable permissions.
Monitor open() and openat() syscalls that target shared directories without O_EXCL or O_NOFOLLOW.

Monitoring Recommendations

Enable Linux audit rules on /tmp and /dev/shm to log symlink creation and file-open events by non-owner users.
Alert when service accounts read or write files owned by other users in shared directories.
Track Perl module inventories via configuration-management tooling to detect regressions to vulnerable versions.

How to Mitigate CVE-2026-65062

Immediate Actions Required

Upgrade Data::SortedSet::Shared to version 0.03 or later on all systems.
Remove any stale world-readable segment files left in /tmp or /dev/shm by previous runs.
Restrict local shell access on hosts running services that depend on the module.

Patch Information

The maintainer fixed the issue in Data::SortedSet::Shared version 0.03. Details are documented in the MetaCPAN Release Changes and the code fix is visible in the MetaCPAN Release Diff, which adds O_EXCL and O_NOFOLLOW and tightens the creation mode.

Workarounds

Relocate the shared segment to a per-user directory such as /run/user/<uid> with mode 0700 where possible.
Set a stricter process umask (for example 077) before invoking code that uses the module.
Use Linux fs.protected_symlinks=1 and fs.protected_regular=1 sysctls to blunt symlink and hard-link attacks in sticky-bit directories.

bash

# Configuration example
sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_regular=1
umask 077
cpanm Data::SortedSet::Shared@0.03