CVE-2026-88815: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-88815 is a type confusion vulnerability in the Perl DBI (Database Interface) module that causes a segmentation fault when sql_type_cast is called with a pure numeric scalar and the SQL_NUMERIC type code. It affects DBI versions before 1.654 and was disclosed on September 26–28, 2026, with the fix released in DBI 1.654 (September 10, 2026). The vulnerability was assigned a CVSS v3.1 base score of 6.2 (Medium), with a local attack vector and high availability impact (GitHub Advisory, Red Hat Bugzilla). The CVE was assigned by CPANSec and is classified as "Deferred" status by Red Hat (Red Hat CVE).

The root cause is a type confusion flaw (CWE-843 / CWE-476) in sql_type_cast_svpv() within DBI.xs. In the SQL_NUMERIC branch (~line 1961), the code calls grok_number(SvPVX(sv), SvCUR(sv), &uv) without first ensuring the Perl scalar value (SV) has a valid string representation (i.e., without checking or setting the SvPOK flag via SvPV()). When the SV is a pure integer (IV) or floating-point (NV) value — which has no associated string pointer — SvPVX(sv) returns NULL or an unmapped memory address, and grok_number() dereferences it, triggering a SIGSEGV (GitHub Advisory, oss-security). The fix in DBI 1.654 replaces the unsafe SvPVX(sv) call with SvPV(sv, len), which forces stringification and handles magic before passing the pointer to grok_number (Patch). The vulnerability is also reachable via DBI drivers that call sql_type_cast_svpv() through the DBIS->sql_type_cast_svpv interface defined in DBIXS.h (GitHub Advisory).

Successful exploitation causes the Perl interpreter to crash with a SIGSEGV (exit code 139), resulting in a denial of service for any process running vulnerable DBI code that passes a numeric scalar to sql_type_cast() with SQL_NUMERIC. There is no confidentiality or integrity impact — the vulnerability is limited to availability (GitHub Advisory, Red Hat Bugzilla). Applications relying on DBI for database connectivity — including those using third-party drivers that internally invoke sql_type_cast_svpv() — are at risk of process termination if they pass uncoerced numeric values to the affected function.

A public proof-of-concept exploit is available in the GitHub Security Advisory, consisting of a single reproducible command: perl -MDBI -e 'my $x=42; DBI::sql_type_cast($x, DBI::SQL_NUMERIC(), 0)', which crashes the interpreter with 100% reliability on DBI 1.653 (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.0021 (low probability of exploitation), and the NVD SSVC assessment classifies exploitation status as "poc" with no automation (Feedly). No threat actor attribution has been reported.

1. Identify vulnerable installations: Determine if the target system has DBI version 1.653 or earlier installed (perl -MDBI -e 'print $DBI::VERSION'). The vulnerability requires local access to a Perl environment with the vulnerable DBI module loaded.
2. Prepare a pure numeric scalar: Create an integer (IV) or floating-point (NV) Perl scalar that has not been stringified — e.g., my $x = 42;, my $x = 3.14;, my $x = 1<<40;, or my $x = -1;. A string-backed scalar like my $x = "42"; $x + 0 (PVIV) is not vulnerable.
3. Invoke the vulnerable function: Call DBI::sql_type_cast($x, DBI::SQL_NUMERIC(), 0) with the numeric scalar and the SQL_NUMERIC type code.
4. Trigger the crash: The sql_type_cast_svpv() C function reads SvPVX(sv) without forcing stringification, passing a NULL or invalid pointer to grok_number(), which dereferences it and causes a SIGSEGV, crashing the Perl interpreter (exit code 139) (GitHub Advisory, oss-security).

• Process: Perl interpreter processes terminating unexpectedly with exit code 139 (SIGSEGV); core dump files generated in the working directory of the Perl process.
• Logs: Application or system logs showing segmentation fault messages associated with Perl processes; entries like Segmentation fault (core dumped) in syslog or application error logs.
• File System: Unexpected core dump files (e.g., core, core.<pid>) in directories where Perl/DBI applications run, potentially containing memory snapshots of the crashed process.

The primary remediation is to upgrade DBI to version 1.654 or later, available on CPAN (cpan install DBI or cpanm DBI). Red Hat has issued security errata addressing this vulnerability: RHSA-2026:76760 (RHEL 9), RHSA-2026:76762 (RHEL 10), and RHSA-2026:77576 (RHEL 8) (Red Hat Bugzilla). SUSE has released SUSE-SU-2026:4442-1 and SUSE-SU-2026:4612-1, and Debian has issued DLA-4798-1 for LTS users. As a temporary workaround where patching is not immediately possible, avoid passing pure numeric (IV/NV) scalars directly to DBI::sql_type_cast() with SQL_NUMERIC — instead, stringify values first (e.g., "$num") before passing them to the function (GitHub Advisory, oss-security).

The vulnerability was reported by researcher Harsh Raj Singhania and disclosed via the CPAN Security Group (CPANSec) through the oss-security mailing list on September 28, 2026 (oss-security). A Reddit post in r/perl noted the discovery of additional segfaults in DBI of the same bug class, suggesting broader community awareness of the issue pattern. The advisory notes that the impact class matches prior DBI advisories CVE-2019-20919 and CVE-2026-60082, indicating a recurring pattern of similar memory safety issues in the module (GitHub Advisory).