CVE-2026-65064: Perl Data::HashMap::Shared Info Leak

CVE-2026-65064 Overview

CVE-2026-65064 affects the Data::HashMap::Shared Perl module in versions before 0.14. The module creates a world-readable memory-mapped backing file for shared memory segments and opens it without O_EXCL or O_NOFOLLOW flags. Local attackers on the same host can read inter-process communication (IPC) payloads or manipulate the file open through symlink attacks and pre-creation races. The flaw is categorized under [CWE-59] (Improper Link Resolution Before File Access, or Link Following) and stems from insecure file creation semantics in shm_generic.h.

Critical Impact
Local users can read sensitive IPC data from world-readable shared memory backing files or redirect file operations through symlink attacks in shared directories like /tmp and /dev/shm.

Affected Products

Data::HashMap::Shared Perl module versions before 0.14
Applications on Linux and Unix-like systems consuming this module for shared memory IPC
Multi-user hosts where the module operates in shared directories such as /tmp or /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-65064 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65064

Vulnerability Analysis

The vulnerability resides in shm_generic.h, which creates the shared memory backing file using open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0666). The mode argument 0666 combined with the default umask of 022 produces a file with permissions 0644, making the segment world-readable. Any local user on the system can therefore read IPC payloads stored in the segment.

Because the call omits O_NOFOLLOW, the kernel follows symbolic links at the target path. Because it omits O_EXCL, the open succeeds silently against a pre-existing file rather than failing. Together, these missing flags convert a routine shared memory setup into a local attack surface.

Root Cause

The root cause is insecure file creation flags in shm_generic.h. The module assumes exclusive ownership of the backing file path without enforcing it through kernel flags. Refer to the MetaCPAN Diff Information for the fix.

Attack Vector

A local unprivileged attacker can exploit the flaw in two ways. First, once a legitimate process creates the segment in a shared directory, the attacker reads the world-readable file directly and extracts IPC contents. Second, the attacker pre-plants a symlink or file at the predictable path before the victim process runs. The victim then opens the attacker-controlled target, allowing redirection or manipulation of the shared segment.

The vulnerability manifests through missing hardening flags rather than logic errors. See the MetaCPAN Change Log for the vendor's remediation notes.

Detection Methods for CVE-2026-65064

Indicators of Compromise

Presence of files in /tmp or /dev/shm with mode 0644 owned by processes using Data::HashMap::Shared
Symlinks in shared IPC directories pointing to sensitive files or attacker-writable locations
Unexpected pre-existing files at paths used by Data::HashMap::Shared before the consuming process starts

Detection Strategies

Audit installed Perl modules with cpan -l or package inventory tooling to identify Data::HashMap::Shared versions below 0.14
Monitor open and openat syscalls targeting /tmp and /dev/shm from Perl processes for missing O_EXCL and O_NOFOLLOW flags
Scan shared temporary directories for world-readable files created by privileged services

Monitoring Recommendations

Enable auditd rules on /tmp and /dev/shm to track file creation and symlink operations by non-root users
Alert on symlink creation immediately followed by file access from a different user context, indicating a potential race
Track process ancestry for Perl interpreters loading Data::HashMap::Shared in multi-user environments

How to Mitigate CVE-2026-65064

Immediate Actions Required

Upgrade Data::HashMap::Shared to version 0.14 or later on all systems where it is installed
Inventory Perl applications that depend on the module and restart them after upgrading to load the patched code
Restrict shell access on multi-user hosts running affected applications until patching is complete

Patch Information

The vendor fixed the issue in Data::HashMap::Shared version 0.14. The patch adds O_EXCL and O_NOFOLLOW to the open call in shm_generic.h and tightens the creation mode. Review the MetaCPAN Change Log and the MetaCPAN Diff Information before deploying.

Workarounds

Configure affected applications to place shared segments in a directory owned by the service account with mode 0700 instead of /tmp or /dev/shm
Set a stricter process-level umask such as 0077 before the module creates its backing file to remove world-readable permissions
Use filesystem access controls or mount options like nosymfollow on directories where the module operates

bash

# Configuration example: restrict umask and use a private IPC directory
umask 0077
mkdir -m 0700 /var/run/myapp-ipc
export HASHMAP_SHARED_DIR=/var/run/myapp-ipc
cpan install Data::HashMap::Shared@0.14