CVE-2026-112935: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filelockto a version that resolves this vulnerability.Fixed in 4.2.1
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using filelock SoftFileLock versions from 3.22.0 up to, but not including, 4.2.1 are affected. The issue concerns SoftFileLock stale-lock breaking behavior.
What does an attacker need to exploit this?
An attacker needs local access and low privileges, as reflected by the CVSS vector. Exploitation requires a timing-sensitive sequence in which the attacker frees its marker after it is observed as stale, an honest contender creates a successor using a reused inode number, and the successor modification time is not newer than the saved observation.
What is the impact if exploitation succeeds?
A live lock marker can be removed, allowing two holders to be admitted simultaneously. The stated CVSS impact is integrity-only, with no confidentiality or availability impact.
How can this be remediated?
Upgrade filelock to version 4.2.1, which fixes the issue.