CVE-2026-65063: Perl RadixTree Information Disclosure Flaw

CVE-2026-65063 Overview

CVE-2026-65063 affects Data::RadixTree::Shared versions before 0.02 for Perl. The module creates a world-readable memory-mapped backing file without safe open flags. The segment is opened in radix.h using open(path, O_RDWR|O_CREAT, 0666), omitting both O_EXCL and O_NOFOLLOW.

Under the default umask of 022, the file lands on disk with mode 0644, exposing IPC payloads to any local user. Because the segment lives in shared directories such as /tmp or /dev/shm, a local attacker can pre-plant a file or symlink at the target path. This lets the attacker win a pre-creation race or redirect the open to an unintended location [CWE-59].

Critical Impact
Local users can read shared inter-process communication (IPC) payloads and redirect file creation through symlink attacks against Perl applications using the affected module.

Affected Products

Data::RadixTree::Shared Perl module versions prior to 0.02
Perl applications on Linux and Unix-like systems that consume this module
Shared memory segments created under /tmp or /dev/shm by the module

Discovery Timeline

2026-07-21 - CVE-2026-65063 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65063

Vulnerability Analysis

The flaw is a symbolic link following vulnerability combined with an insecure file permission issue. The module’s C header radix.h invokes open(path, O_RDWR|O_CREAT, 0666) to create its shared-memory backing file. Two safety flags are missing from that call.

Without O_EXCL, the open call succeeds silently when a file already exists at the target path. Without O_NOFOLLOW, the kernel follows any symbolic link planted at that path. Combined with a 0666 creation mode and a typical umask of 022, the resulting file is created world-readable (0644).

Because a "Shared" segment is designed to live in a shared directory, the path is predictable and writable by any local user. Local attackers can read the IPC payloads directly from the backing file. They can also stage a file or symlink beforehand to hijack the open.

Root Cause

The root cause is unsafe file creation semantics in radix.h. The developer relied on default open(2) behavior in a multi-user directory without defensive flags. The mode argument 0666 compounds the issue by granting broad read access after umask masking.

Attack Vector

Exploitation requires local access and low privileges. An attacker predicts or observes the backing file path used by the module. Before the target process creates the segment, the attacker places a symlink or a pre-created file at that path. When the victim application opens the segment, it follows the symlink or reuses the attacker-controlled file. The attacker can then read shared IPC payloads or influence subsequent operations against the redirected target. See the MetaCPAN Release Diff for radix.h for the source-level change.

Detection Methods for CVE-2026-65063

Indicators of Compromise

Unexpected symbolic links residing in /tmp or /dev/shm that resolve to paths owned by other users or to sensitive files.
Backing files created by Data::RadixTree::Shared with world-readable permissions (0644) in shared directories.
Unauthorized local processes performing readlink, stat, or open operations against known module segment paths.

Detection Strategies

Audit installed Perl module inventories for Data::RadixTree::Shared at versions below 0.02.
Monitor file creation events in /tmp and /dev/shm for open calls lacking O_EXCL and O_NOFOLLOW using auditd or eBPF-based tracing.
Correlate short-lived symlink creation in world-writable directories with subsequent access by higher-privileged Perl processes.

Monitoring Recommendations

Enable Linux audit rules that log openat syscalls targeting /tmp/* and /dev/shm/* with O_CREAT set.
Alert on any non-root process creating symlinks whose target paths match segment names used by Perl services.
Review process telemetry for reads of module backing files by user identifiers other than the owning service account.

How to Mitigate CVE-2026-65063

Immediate Actions Required

Upgrade Data::RadixTree::Shared to version 0.02 or later on all systems that use the module.
Restrict local shell access on hosts running affected Perl services to reduce the local attacker population.
Relocate shared segment paths to directories not writable by unprivileged users where the application permits.

Patch Information

The maintainer released Data::RadixTree::Shared 0.02, which updates the open call in radix.h to include safer flags and reduce the creation mode. Details are documented in the MetaCPAN Release Changes and the source diff between 0.01 and 0.02.

Workarounds

Set a stricter process umask such as 077 before invoking Perl services that use the module to reduce world readability.
Configure /tmp with the sticky bit and consider fs.protected_symlinks=1 and fs.protected_regular=1 to blunt symlink and hardlink attacks.
Run affected Perl services under a dedicated user with a private runtime directory such as /run/<service> that excludes other local users.

bash

# Configuration example: harden symlink handling and process umask
sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_regular=1
umask 077
cpanm Data::RadixTree::Shared@0.02