CVE-2026-65069: Perl DisjointSet Information Disclosure

CVE-2026-65069 Overview

CVE-2026-65069 affects the Data::DisjointSet::Shared Perl module in versions before 0.02. The module creates a world-readable memory-mapped backing file for its shared inter-process communication (IPC) segment. The file is opened without the O_EXCL or O_NOFOLLOW flags, exposing the process to symlink attacks and pre-creation races on shared directories such as /tmp or /dev/shm. Any local user on the system can read IPC payloads stored in the segment, and an attacker who plants a file or symlink at the target path can influence which file the module opens. The weakness is categorized under [CWE-59] Improper Link Resolution Before File Access.

Critical Impact
Local users can read shared IPC data or redirect segment creation through symlink attacks, enabling information disclosure and potential data tampering on multi-user systems.

Affected Products

Data::DisjointSet::Shared for Perl, versions prior to 0.02
Systems running the module in shared directories such as /tmp or /dev/shm
Multi-user Linux and Unix hosts where local accounts share filesystem access

Discovery Timeline

2026-07-21 - CVE-2026-65069 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-65069

Vulnerability Analysis

The module's dsu.h component creates the shared memory backing file using open(path, O_RDWR|O_CREAT, 0666). The mode argument 0666 combined with the default umask 022 produces a file with permissions 0644, making it world-readable. Any local user can read the mapped IPC data, which may include application state, identifiers, or intermediate computation results shared between processes.

The open call omits O_NOFOLLOW, so if a symlink already exists at the target path, the system follows it and operates on the linked target. The call also omits O_EXCL, so the open silently reuses any pre-existing file at the path rather than failing. Both omissions weaken the guarantees a program should have when creating IPC-backing files in shared directories.

Root Cause

The root cause is unsafe file creation in a shared, world-writable directory. The code trusts that the path does not already exist and that it is not a symlink. Neither assumption holds in /tmp or /dev/shm, where any local user can create arbitrary paths. The permissive 0666 mode compounds the problem by granting read access to all local accounts.

Attack Vector

A local attacker with unprivileged shell access performs the attack in two ways. First, they read the world-readable segment directly to exfiltrate IPC contents while the module is in use. Second, they win a race by pre-creating the target path — either as a regular file with attacker-controlled contents or as a symlink pointing to a sensitive file — before the vulnerable process runs. When the process opens the path, it operates on the attacker-planted target instead of a fresh segment.

See the MetaCPAN Release Diff for the code-level changes that address the flaw.

Detection Methods for CVE-2026-65069

Indicators of Compromise

Presence of world-readable files or symlinks in /tmp or /dev/shm matching the module's backing-file naming pattern
Unexpected symlinks in shared IPC directories pointing to sensitive files owned by other users
Backing files created with mode 0644 rather than a restrictive mode such as 0600

Detection Strategies

Audit installed Perl modules and flag any Data::DisjointSet::Shared version below 0.02
Scan runtime hosts for backing files in /tmp and /dev/shm whose permissions include world-read access
Monitor open and openat syscalls that create files in shared directories without O_EXCL or O_NOFOLLOW

Monitoring Recommendations

Enable filesystem auditing (auditd) on /tmp and /dev/shm for file creation events
Log processes that invoke the affected Perl module and correlate with backing-file activity
Alert on symlink creation in shared directories by unprivileged users targeting known IPC paths

How to Mitigate CVE-2026-65069

Immediate Actions Required

Upgrade Data::DisjointSet::Shared to version 0.02 or later on all affected hosts
Inventory Perl applications that depend on the module and confirm rebuild against the patched release
Remove stale backing files and symlinks from /tmp and /dev/shm before restarting affected services

Patch Information

The upstream fix ships in Data::DisjointSet::Shared version 0.02. Refer to the MetaCPAN Release Changes for the changelog and the MetaCPAN Release Diff for the code changes to dsu.h.

Workarounds

Run affected processes with a restrictive umask such as 0077 so newly created files exclude group and world permissions
Direct the module to a per-user directory not writable by other accounts, avoiding /tmp and /dev/shm
Use Linux namespaces or containers to isolate the process filesystem from other local users until patching is complete

bash

# Configuration example
umask 0077
mkdir -m 0700 -p /run/user/$(id -u)/dsu
export TMPDIR=/run/user/$(id -u)/dsu
cpan install Data::DisjointSet::Shared@0.02