EUVD-2026-105029

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker...

GHSA-RFPC-QCW5-3PC4 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who...

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants and a FileLock that has fallen back to a soft lock on ENOSYS decide from the record inside the marker file whether its owner is gone. The marker is the file whose presence says a process holds the lock. They do not check who...

GHSA-9J6Q-WVJ5-JGJG filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

raiseonnotwritablefile is the check that SoftFileLock and the locks sharing its acquire path run before every attempt. It looks at the lock path with os.lstat, so that it judges a planted symlink a file that points at another path by itself. When the node has no owner-write bit, it then calls...

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

raiseonnotwritablefile is the check that SoftFileLock and the locks sharing its acquire path run before every attempt. It looks at the lock path with os.lstat, so that it judges a planted symlink a file that points at another path by itself. When the node has no owner-write bit, it then calls...

EUVD-2026-105019

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker...

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

The stale-lock break shared by SoftFileLock, MarkerSoftFileLock and SoftFileLease and their async variants, and a FileLock that has fallen back to a soft lock on ENOSYS, the "not implemented" error recognises the marker it judged stale by two values. The marker is the lock file at , whose presenc...

GHSA-FQ56-3CX3-FJXP filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders

The stale-lock break shared by SoftFileLock, MarkerSoftFileLock and SoftFileLease and their async variants, and a FileLock that has fallen back to a soft lock on ENOSYS, the "not implemented" error recognises the marker it judged stale by two values. The marker is the lock file at , whose presenc...

EUVD-2026-105025

filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders...

EUVD-2026-105015

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse...

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

SoftFileLock and MarkerSoftFileLock evict an unparsable marker the lock file at , whose presence says a process holds the lock once a waiting contender has watched it unchanged for two seconds. SoftFileLease expires a lease the same way. The watch tells two looks apart by the marker's modificatio...

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

When a soft-lock stale break finds that the marker the lock file at it renamed aside was a live one recreated by a successor, the restore branch of breaklockfile checks the break name with lstat a check that reads a name without following a symbolic link and then calls os.linkbreakpath, lockfile ...

EUVD-2026-105020

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory...

SUSE CVE-2026-112906

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

SUSE CVE-2026-112912

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that...

SUSE CVE-2026-112914

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link...

SUSE CVE-2026-112935

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not...

SUSE CVE-2026-112939

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

Linux Distros Unpatched Vulnerability : CVE-2026-112939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-112912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.acce...