CVE-2026-65065: Data::RoaringBitmap::Shared Disclosure Flaw

CVE-2026-65065 Overview

CVE-2026-65065 affects the Data::RoaringBitmap::Shared Perl module in versions before 0.02. The module creates a world-readable memory-mapped backing file without O_EXCL or O_NOFOLLOW flags. Any local user can read the inter-process communication (IPC) payloads stored in the shared segment. A local attacker can also pre-plant a file or symlink at the target path to win a race condition or redirect the file open operation. The flaw is classified under [CWE-59] Improper Link Resolution Before File Access (Link Following).

Critical Impact
Local attackers can read sensitive IPC data from world-readable shared segments or hijack file creation through symlink attacks in shared directories like /tmp and /dev/shm.

Affected Products

Data::RoaringBitmap::Shared for Perl, versions prior to 0.02
Applications using the module for shared bitmap IPC in world-writable directories
Multi-user Linux and Unix systems where the module places segments in /tmp or /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-65065 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65065

Vulnerability Analysis

The module implements a shared bitmap segment for cross-process communication. In roaring.h, the segment file is created with open(path, O_RDWR|O_CREAT, 0666). Three problems compound in this single call. The mode 0666 combined with the default umask 022 yields a file mode of 0644, making the segment world-readable. The absence of O_NOFOLLOW causes open() to follow symbolic links at the target path. The absence of O_EXCL allows open() to silently reuse an existing file rather than fail on collision.

Because a "Shared" segment naturally resides in a shared directory such as /tmp or /dev/shm, any local user can enumerate and read the IPC payloads. The module leaks whatever data producers write into the bitmap.

Root Cause

The root cause is insecure file creation in a shared directory. The open() call trusts the target path without validating that it is a new, non-symlink file owned by the caller. The overly permissive mode 0666 violates least privilege for IPC data intended only for cooperating processes.

Attack Vector

A local unprivileged attacker has two exploitation paths. First, passive disclosure: the attacker reads the world-readable segment while a legitimate process writes IPC data. Second, active manipulation: the attacker pre-plants a symlink at the predictable segment path pointing to a file the victim can write but the attacker controls, or pre-creates the file itself with attacker-controlled permissions. When the victim opens the segment, the module writes into the attacker-designated file. The vulnerability is described in the MetaCPAN release diff.

Detection Methods for CVE-2026-65065

Indicators of Compromise

Files in /tmp or /dev/shm with mode 0644 or 0666 created by processes loading Data::RoaringBitmap::Shared
Symbolic links in shared directories pointing to sensitive files owned by other users
Unexpected file ownership on shared bitmap segments where the writer differs from the module's calling process

Detection Strategies

Audit installed Perl modules for Data::RoaringBitmap::Shared versions below 0.02 using cpan -l or package inventory tools
Monitor open() and openat() syscalls with auditd or eBPF probes targeting shared directories for missing O_EXCL and O_NOFOLLOW flags
Scan /tmp and /dev/shm periodically for world-readable IPC segments created by service accounts

Monitoring Recommendations

Log file creation events in /tmp and /dev/shm and alert on symlink creation followed by target-file access by a different UID
Track process execution of Perl interpreters loading the affected module and correlate with file system telemetry
Enable Linux kernel fs.protected_symlinks and fs.protected_hardlinks sysctls and alert on kernel denials that indicate exploitation attempts

How to Mitigate CVE-2026-65065

Immediate Actions Required

Upgrade Data::RoaringBitmap::Shared to version 0.02 or later from CPAN
Inventory hosts running Perl applications that depend on the module and prioritize multi-user systems
Remove any stale segment files left in /tmp or /dev/shm by prior vulnerable versions

Patch Information

The maintainer released version 0.02 to address the issue. Details are documented in the MetaCPAN release changes and the source diff. The fix hardens the open() call by using restrictive permissions and adding flags that prevent symlink following and silent reuse of pre-existing files.

Workarounds

Relocate shared segments to a directory that is not world-writable, such as a per-application directory under /var/run with mode 0700
Tighten the process umask to 077 before the module opens its segment so the resulting file mode becomes 0600
Enable fs.protected_symlinks=1 and fs.protected_hardlinks=1 in sysctl to block cross-user symlink following in sticky directories

bash

# Configuration example
cpan install EGOR/Data-RoaringBitmap-Shared-0.02.tar.gz
sysctl -w fs.protected_symlinks=1
sysctl -w fs.protected_hardlinks=1
umask 077