Bug 2556214 (CVE-2026-112934)

Summary: CVE-2026-112934 filelock: filelock: Denial of Service via insecure holder record refresh
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cahl, cmyers, dfreiber, dnakabaa, dpaolell, drow, dschmidt, dtrifiro, ebourniv, ehelms, gbenhaim, ggainey, hasun, hoberger, ilpinto, jburrell, jdelft, jdobes, jfula, jholecek, jlanda, jmitchel, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kgaikwad, kshier, lcouzens, lgarciaa, ljawale, lpele, ltomasbo, mbarnett, mbiarnes, mdellweg, mhayden, mhulan, msilmser, mwoodson, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, sarad, sbunciak, sdawley, sdoran, sghai, sidsharm, simaishi, smallamp, sprizend, stcannon, suppawar, syedriko, tmalecek, twaugh, vkumar, vlaad, weaton, xdharmai, yguenane, ykashtan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in filelock. A local user with rename permissions in the lock directory can cause a Denial of Service (DoS) by replacing lock holder records with a named pipe, causing locking operations to stall indefinitely. Under permissive file system policies, an attacker can also link target files to trick the locking process into unintentionally overwriting data. This issue occurs because the lock mechanism refreshes holder records by file name without safely validating file attributes.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 14:46:42 UTC 
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.