Bug 2567955 (CVE-2026-112908)

Summary: CVE-2026-112908 filelock: filelock: unauthorized concurrent access via insecure claim directory permissions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, alinfoot, anpicker, aos-team-art-private, aprice, asdas, bbrownin, blitton, cahl, cmyers, dfreiber, dnakabaa, dpaolell, drow, dtrifiro, ebourniv, ehelms, gbenhaim, hasun, hoberger, ilpinto, jburrell, jdelft, jdobes, jfula, jholecek, jlanda, jmitchel, jowilson, jpasqual, jsamir, jupierce, juwatts, jwong, kaycoth, kgaikwad, kshier, lblicha, lcouzens, lgarciaa, ljawale, lpele, ltomasbo, mbarnett, mbiarnes, mhayden, mhulan, msilmser, mwoodson, niyer, nyancey, oezr, ogajduse, ometelka, orabin, osousa, ppalepu, ppostler, prdhamdh, prwatson, ptisnovs, rbobbitt, rchan, sarad, sbunciak, sdawley, sdoran, sghai, sidsharm, simaishi, smallamp, sprizend, stcannon, suppawar, syedriko, tguha, twaugh, vkumar, vlaad, weaton, xdharmai, yguenane, ykashtan, zhunting, zzhou
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in filelock. When creating strict file locks on POSIX-compliant systems, coordination and claim directories are created without applying the caller's restrictive file permission settings. In environments with permissive file creation masks or default access control lists (ACLs), a local attacker can delete active lock claims or introduce invalid claim records into these directories. This can lead to unauthorized concurrent access to protected resources, potentially resulting in data corruption, or cause a denial of service (DoS) by preventing legitimate processes from acquiring locks.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:41:47 UTC 
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1,  StrictSoftFileLock  and  AsyncStrictSoftFileLock  on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1.