CVE-2026-65067: Perl Data::Intern::Shared Disclosure Flaw

CVE-2026-65067 Overview

CVE-2026-65067 affects Data::Intern::Shared versions before 0.02 for Perl. The module creates a world-readable memory-mapped backing file used for inter-process communication (IPC). The segment is opened without the O_EXCL or O_NOFOLLOW flags, which allows a local attacker to plant a symlink or file at the target path. Because the segment lives in a shared directory such as /tmp or /dev/shm, any local user can read the IPC payloads stored in the world-readable file. The weakness is classified as [CWE-59] (Link Following).

Critical Impact
Local users can read shared IPC payloads and hijack the backing file through symlink or pre-creation attacks against Data::Intern::Shared before 0.02.

Affected Products

Data::Intern::Shared for Perl, versions prior to 0.02
Applications embedding the vulnerable intern.h shared segment logic
Systems where the module writes to shared directories such as /tmp or /dev/shm

Discovery Timeline

2026-07-21 - CVE-2026-65067 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65067

Vulnerability Analysis

The flaw resides in intern.h, which creates the shared mmap backing file with open(path, O_RDWR|O_CREAT, 0666). Two problems compound each other. First, the mode 0666 combined with the default umask 022 produces a file with permissions 0644, making the IPC payload world-readable. Second, the call omits both O_NOFOLLOW and O_EXCL, so the kernel follows symlinks and silently reuses any pre-existing file at the path.

Because the segment name lives in a shared directory such as /tmp or /dev/shm, any unprivileged local user on the host can read the payloads written into the region. A local attacker can also pre-plant a file or symlink at the expected path before the victim process runs.

Root Cause

The root cause is insecure use of open(2) for creating a file in a world-writable, shared directory. The absence of O_EXCL removes the atomic create-or-fail guarantee, and the absence of O_NOFOLLOW allows symlink traversal. The permissive 0666 mode compounds the exposure by removing confidentiality for other local users.

Attack Vector

Exploitation requires local access with the ability to write into the shared directory used by the module. An attacker enumerates predictable segment paths and either reads the world-readable file directly to capture IPC data or plants a symlink or file at the path before the victim process opens it. Winning the pre-creation race redirects the open to an attacker-controlled inode, letting the attacker observe or influence the shared segment.

No verified exploit code is publicly available. See the MetaCPAN Release Diff for the exact source change.

Detection Methods for CVE-2026-65067

Indicators of Compromise

Unexpected files or symlinks in /tmp or /dev/shm matching Data::Intern::Shared segment naming patterns
World-readable (0644) backing files owned by service accounts running Perl workloads
Symlinks in shared temporary directories pointing to sensitive files owned by the victim process user

Detection Strategies

Audit installed Perl modules for Data::Intern::Shared versions below 0.02 using cpan -l or package inventory tooling
Monitor open and openat syscalls targeting shared directories without O_EXCL or O_NOFOLLOW via auditd or eBPF probes
Flag creation of world-readable files by processes that handle sensitive IPC data

Monitoring Recommendations

Log file creation events in /tmp and /dev/shm and alert on symlink creation targeting predictable segment paths
Track process ancestry for Perl interpreters loading Data::Intern::Shared to correlate with file activity
Review permissions on existing shared memory backing files during routine host hardening scans

How to Mitigate CVE-2026-65067

Immediate Actions Required

Upgrade Data::Intern::Shared to version 0.02 or later from CPAN
Inventory hosts running Perl services that depend on the module and prioritize patching for multi-user systems
Remove any stale world-readable backing files left by earlier versions in /tmp and /dev/shm

Patch Information

The maintainer released Data::Intern::Shared 0.02, which corrects the open call in intern.h. Details are documented in the MetaCPAN Release Changes and the MetaCPAN Release Diff.

Workarounds

Restrict access to shared directories using the sticky bit and per-user tmp namespaces such as systemdPrivateTmp=yes
Run affected Perl services under dedicated users with isolated temporary directories not shared with untrusted local accounts
Tighten the process umask to 077 so newly created files default to owner-only permissions until the module is upgraded

bash

# Configuration example: isolate shared tmp and enforce restrictive umask for a systemd service
[Service]
PrivateTmp=yes
UMask=0077