CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-112906

The filelock Python library (versions 4.1.0 through 4.2.1 ) is vulnerable to a flaw in SoftFileLock where it may reuse a stale observation from another local user's file through inode reuse . If an attacker pre-dates and removes their own marker, and specific conditions regarding modification tim...