Filelock: SoftReadWriteLock Follows A Lock Tree Swapped In After Its First Acquire And Writes Lock Records Into Director

"SoftReadWriteLock" and "AsyncSoftReadWriteLock", which wraps one checks once per lock object, by name, that ".rw", ".rw/gen" and ".rw/holders" are real directories and not symbolic links files that redirect to another path. It then keeps only a boolean. Every later record operation resolves the...

Filelock: SoftReadWriteLock Holder Refresh Writes Through A Hard Link And Hangs On A Named Pipe That Another Local User

"SoftReadWriteLock" and "AsyncSoftReadWriteLock", which wraps one refreshes its holder record the file under ".rw/holders/" that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so...

Filelock: StrictSoftFileLock And SoftReadWriteLock Adopt A Protocol Directory Another User Created First, Losing Mutual

"StrictSoftFileLock", "AsyncStrictSoftFileLock", "SoftReadWriteLock" and "AsyncSoftReadWriteLock" keep their whole ownership state as files in a directory derived from the lock path ".filelock/claims", ".rw/gen,holders". When that directory already exists they adopt it after checking only that it...

EUVD-2026-105032

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock...

filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one checks once per lock object, by name, that .rw, .rw/gen and .rw/holders are real directories and not symbolic links files that redirect to another path. It then keeps only a boolean. Every later record operation resolves the full path...

GHSA-WFHQ-Q4J2-C37M filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one checks once per lock object, by name, that .rw, .rw/gen and .rw/holders are real directories and not symbolic links files that redirect to another path. It then keeps only a boolean. Every later record operation resolves the full path...

GHSA-9C4X-GM8V-WGC4 filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

StrictSoftFileLock, AsyncStrictSoftFileLock, SoftReadWriteLock and AsyncSoftReadWriteLock keep their whole ownership state as files in a directory derived from the lock path .filelock/claims, .rw/gen,holders. When that directory already exists they adopt it after checking only that it is a real...

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion

StrictSoftFileLock, AsyncStrictSoftFileLock, SoftReadWriteLock and AsyncSoftReadWriteLock keep their whole ownership state as files in a directory derived from the lock path .filelock/claims, .rw/gen,holders. When that directory already exists they adopt it after checking only that it is a real...

EUVD-2026-105018

filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion...

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one refreshes its holder record the file under .rw/holders/ that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so by...

EUVD-2026-105023

filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record...

GHSA-FJ95-FR6C-H845 filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record

SoftReadWriteLock and AsyncSoftReadWriteLock, which wraps one refreshes its holder record the file under .rw/holders/ that says a process holds or wants the lock on every poll of a waiting acquire and on every heartbeat the periodic refresh a holder runs to keep its record fresh. It does so by...

SUSE CVE-2026-112911

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol...

SUSE CVE-2026-112934

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link polic...

SUSE CVE-2026-112941

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations, allowing another local user who can replace that tree after the...

Linux Distros Unpatched Vulnerability : CVE-2026-112941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .r...

Linux Distros Unpatched Vulnerability : CVE-2026-112911

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from...

Linux Distros Unpatched Vulnerability : CVE-2026-112934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user...

CVE-2026-112941

A flaw was found in filelock. The SoftReadWriteLock and AsyncSoftReadWriteLock mechanisms cache an initial directory check but resolve path names again during subsequent record operations. A local attacker can exploit this behavior by replacing the lock directory structure after its initial...

UNIX Hard Link

Overview Affected versions of this package are vulnerable to UNIX Hard Link via OsFiles.overwrite in SoftReadWriteLock, which refreshes holder records by name without verifying the file identity. A local attacker who has rename access to the lock directory can replace a holder record with a named...