EUVD-2026-105017

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-112909

The filelock Python library contains a vulnerability in UnixFileLock prior to version 4.2.1 . A local user can cause the library to truncate or change the mode of a regular file if that file is renamed or hard-linked onto the lock path by another user (who has rename permissions or a permissive h...

CVE-2026-112909 filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected...

CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906

The filelock Python library (versions 4.1.0 through 4.2.1 ) is vulnerable to a flaw in SoftFileLock where it may reuse a stale observation from another local user's file through inode reuse . If an attacker pre-dates and removes their own marker, and specific conditions regarding modification tim...

PT-2026-118396

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

PT-2026-118393

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that...

PT-2026-118401

Name of the Vulnerable Software and Affected Versions filelock versions 3.20.4 through 4.2.0 Description The ReadWriteLock allows SQLite to reopen the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap these names to trigger...

PT-2026-118394

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock component, the software can restore a stale marker by name after moving it aside. This allows a local user with rename access in a non-sticky lock directory to replace the...

PT-2026-118399

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description The ReadWriteLock function can remove a randomized .filelock- private-hard-link directory during cleanup. This allows a local user with rename access in a non-sticky parent directory to observe...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

tox-dev filelock: race condition issue

The tox-dev filelock version 4.1.0 to 4.2.1 had a race condition vulnerability. This vulnerability stemmed from SoftFileLock’s ability to restore files by their name after removing an outdated marker. This allowed local users with rename privileges in non-sticky lock directories to replace symbol...

tox-dev filelock: Processing logic error vulnerability

The tox-dev filelock version 4.1.0 to 4.2.1 contained a processing logic vulnerability. This vulnerability stemmed from the SoftFileLock component reusing outdated observation results when at least two lock user processes were waiting. An attacker could set and delete their own markers, and use...

tox-dev filelock: race condition issue

The tox-dev filelock version 3.20.4 up to version 4.2.1 has a race condition vulnerability. This vulnerability stems from the ReadWriteLock mechanism, which allows SQLite to reopen databases and associated files by their names. Attackers with renaming privileges on POSIX systems can replace these...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: filelock: The lock is removed reliably when a race condition involving fcntl/close is detected. When a race condition occurs between fcntlsetlk and close, the created lock is removed using dolockfilewait. However, LSMs may all...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4276)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...