Bug 2556215 (CVE-2026-112914)

Summary: CVE-2026-112914 filelock: filelock: Unauthorized file exposure via symbolic link manipulation in SoftFileLock
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, anthomas, aos-team-art-private, aprice, asdas, bbrownin, blitton, cahl, cmyers, dfreiber, dnakabaa, dpaolell, drow, dschmidt, dtrifiro, ebourniv, ehelms, gbenhaim, ggainey, hasun, hoberger, ilpinto, jburrell, jdelft, jdobes, jfula, jholecek, jlanda, jmitchel, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kgaikwad, kshier, lcouzens, lgarciaa, ljawale, lpele, ltomasbo, mbarnett, mbiarnes, mdellweg, mhayden, mhulan, msilmser, mwoodson, niyer, nmoumoul, nyancey, oezr, omaciel, ometelka, orabin, osousa, pcreech, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, sarad, sbunciak, sdawley, sdoran, sghai, sidsharm, simaishi, smallamp, sprizend, stcannon, suppawar, syedriko, tmalecek, twaugh, vkumar, vlaad, weaton, xdharmai, yguenane, ykashtan, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in filelock. A local attacker with write access to a shared lock directory can exploit the SoftFileLock mechanism to cause unauthorized file exposure. When filelock restores a stale lock marker by name, the attacker can swap in a symbolic link, causing the victim's process to create a hard link to its own files inside the shared directory. This allows unauthorized local users to access or modify sensitive files on the same filesystem.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-20 14:47:33 UTC 
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory. This issue is fixed in version 4.2.1.