CVE-2026-65068: Perl Data::SpatialHash::Shared Disclosure

CVE-2026-65068 Overview

CVE-2026-65068 affects Data::SpatialHash::Shared versions before 0.02 for Perl. The module creates a world-readable memory-mapped (mmap) backing file and opens it without the O_EXCL or O_NOFOLLOW flags. The segment resides in a shared directory such as /tmp or /dev/shm, exposing inter-process communication (IPC) payloads to any local user. A local attacker can also plant a symlink or file at the target path to redirect the open or win a pre-creation race [CWE-59].

Critical Impact
Local users on the same host can read shared IPC payloads and manipulate the mmap backing file through symlink following, compromising the confidentiality of data handled by the Perl module.

Affected Products

Data::SpatialHash::Shared for Perl, versions prior to 0.02
Applications and services embedding the vulnerable module on shared multi-user systems
Deployments using /tmp or /dev/shm as the backing directory for the shared segment

Discovery Timeline

2026-07-21 - CVE-2026-65068 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65068

Vulnerability Analysis

The flaw resides in sphash.h, where the module creates its mmap backing file using open(path, O_RDWR|O_CREAT, 0666). The mode argument of 0666, combined with the default umask of 022, produces a file with permissions 0644. Any local account can read the resulting segment.

The module also omits two critical flags. Without O_NOFOLLOW, open() follows symbolic links planted at the target path. Without O_EXCL, the call succeeds against a pre-existing file rather than failing. Combined, these omissions produce a classic link-following file-handling weakness classified under [CWE-59].

Because a "Shared" segment is designed to sit in a world-writable directory such as /tmp or /dev/shm, a local attacker has direct access to the parent directory. The attacker can pre-create a file, plant a symlink pointing elsewhere, or race the module during segment creation.

Root Cause

The root cause is missing hardening flags in the open() invocation and a permissive file mode. The developer relied on open() defaults instead of enforcing exclusive creation and disallowing symlink traversal on a security-sensitive path in a shared directory.

Attack Vector

Exploitation requires local access with an unprivileged account on the same host. The attacker either reads the world-readable segment to harvest IPC payloads or places a symlink at the expected backing-file path before the victim process runs. When the victim calls open(), the kernel follows the symlink and the module writes IPC data into an attacker-chosen location. The CWE-59 primitive can also be used to redirect writes to files owned by the victim user.

See the MetaCPAN Release Diff for the exact source-level change in sphash.h.

Detection Methods for CVE-2026-65068

Indicators of Compromise

Backing files created by the module in /tmp or /dev/shm with mode 0644 or broader read permissions
Symbolic links present at expected mmap backing-file paths before the Perl process starts
Unexpected file ownership or link targets for files associated with Data::SpatialHash::Shared segments

Detection Strategies

Inventory Perl environments and identify installations of Data::SpatialHash::Shared older than 0.02 using cpan -l or package manifests
Audit filesystem telemetry for open() or openat() syscalls against paths in /tmp and /dev/shm that resolve through symlinks owned by non-root users
Review process execution logs for Perl workloads that instantiate shared spatial hash segments on multi-user hosts

Monitoring Recommendations

Enable Linux audit rules on /tmp and /dev/shm to capture file creation events, symlink creation, and unlink operations near module startup
Alert on world-readable files created by service accounts in shared temporary directories
Track read access from unexpected user IDs to files known to hold IPC payloads for the module

How to Mitigate CVE-2026-65068

Immediate Actions Required

Upgrade Data::SpatialHash::Shared to version 0.02 or later on all Perl hosts
Restrict local shell access on systems where the module runs, particularly multi-tenant hosts
Move backing files out of world-writable directories and into a directory owned by the service account with mode 0700

Patch Information

The maintainer released Data::SpatialHash::Shared version 0.02 with corrected open() semantics in sphash.h. Review the MetaCPAN Release Changes for the fix summary and the MetaCPAN Release Diff for the source change.

Workarounds

Set a stricter umask such as 0077 for the process invoking the module to reduce the file mode on creation
Point the backing file to a private directory such as /run/<service>/ owned by the service account with 0700 permissions
Remove residual backing files at service shutdown and validate that no symlink exists at the target path before startup

bash

# Configuration example
# Upgrade the vulnerable module from CPAN
cpanm Data::SpatialHash::Shared@0.02

# Harden the runtime environment for the invoking service
umask 0077
install -d -m 0700 -o svcuser -g svcuser /run/spatialhash