Bug 2556212 (CVE-2026-112935)

Summary: CVE-2026-112935 filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cahl, cmyers, dfreiber, dnakabaa, dpaolell, drow, dschmidt, dtrifiro, ebourniv, ehelms, gbenhaim, ggainey, hasun, hoberger, ilpinto, jburrell, jdelft, jdobes, jfula, jholecek, jlanda, jmitchel, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kgaikwad, kshier, lcouzens, lgarciaa, ljawale, lpele, ltomasbo, mbarnett, mbiarnes, mdellweg, mhayden, mhulan, msilmser, mwoodson, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, sarad, sbunciak, sdawley, sdoran, sghai, sidsharm, simaishi, smallamp, sprizend, stcannon, suppawar, syedriko, tmalecek, twaugh, vkumar, vlaad, weaton, xdharmai, yguenane, ykashtan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in filelock. A local attacker can exploit a race condition in the SoftFileLock mechanism during stale lock cleanup. Under specific timing and file system conditions involving reused file nodes, filelock may mistakenly delete an active lock marker held by another process. This failure in mutual exclusion allows multiple processes to acquire the lock simultaneously, potentially resulting in conflicting file modifications and data corruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 14:44:58 UTC 
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.