fkie_cve-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

GHSA-2g95-wg33-c5x2 — filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through…

Affected: PyPI: filelock

`SoftFileLock` and `MarkerSoftFileLock` evict an unparsable marker (the lock file at `<path>`, whose presence says a process holds the lock) once a waiting contender has watched it unchanged for two seconds. `SoftFileLease` expires a lease the same way. The watch tells two looks apart by the marker's modification time (mtime) and inode number (the kernel's identity for a file, independent of its name) alone.

Another local user (the other user below) who can create files in the lock's directory, a sticky `/tmp` included (the sticky bit is a directory flag that lets only a file's owner remove it), parks an empty file of its own at the lock path. It dates that file to a future tick of the kernel's coarse clock (a clock that advances in steps of 4 ms), lets the waiters of the user running the lock (the lock user below) watch it past two seconds, and unlinks it in that tick. On a filesystem that hands a freed inode number straight back (ext4, overlayfs on ext4) the lock user's next marker repeats both values. It inherits the time spent watching the other user's file, and a second waiter removes it while its owner holds the lock.

Two of the lock user's processes then run the critical section together with no error. A `SoftFileLease` waiter takes a live lease that its owner wrote moments before, within milliseconds instead of after `lease_duration`. Affected versions: filelock >= 4.1.0 and <= 4.2.0 (finding `ANT-2026-RKC48J5B`).

## Severity

**CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:…

UBUNTU-CVE-2026-112906

Affected: Ubuntu:Pro:18.04:LTS: python-filelock, Ubuntu:Pro:20.04:LTS: python-filelock, Ubuntu:Pro:22.04:LTS: python-filelock, Ubuntu:Pro:24.04:LTS: python-filelock, Ubuntu:26.10: python-filelock, Ubuntu:26.04:LTS: python-filelock

(filelock is a platform-independent file lock for Python. From 4.1.0 un ...)

Most recent entries from all

fkie_cve-2026-112906

GHSA-2g95-wg33-c5x2 — filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through…

UBUNTU-CVE-2026-112906