CVE-2026-112906

Analyzed Analyzed - Analysis Complete

Race Condition in filelock Library

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the observation, and an honest contender creates a fresh marker on the reused inode, causing that live marker to be removed as stale. This issue is fixed in version 4.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112906

EUVD

EUVD-2026-105015

Affected Vendors & Products

Vendor	Product	Version / Range
tox-dev	filelock	From 4.1.0 (inc) to 4.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-694	The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the filelock library's SoftFileLock versions 4.1.0 to 4.2.0. An attacker can bypass file locks by exploiting inode reuse and filesystem timestamp behavior. The attacker creates a pre-dated empty file in a sticky directory, sets its modification time to a future kernel clock tick, and removes it at the precise moment. When lock user processes attempt to acquire the lock, they may inherit the attacker's file's inode and timestamp, causing the lock eviction mechanism to incorrectly remove a valid lock file. This allows two processes to simultaneously enter the critical section protected by the lock.

Detection Guidance

Detecting this vulnerability requires checking if your system uses filelock versions 4.1.0 to 4.2.0. Run: pip show filelock to check the installed version. If using a sticky directory like /tmp on ext4 or overlayfs filesystems, monitor for unexpected lock evictions or concurrent process access to critical sections.

Impact Analysis

This vulnerability allows local attackers to bypass file locks, potentially leading to unauthorized access to shared resources or data corruption. If exploited, two processes could simultaneously enter a critical section protected by the lock, causing race conditions, inconsistent states, or data integrity issues. The impact is limited to local attackers and requires specific filesystem conditions like ext4 or overlayfs.

Compliance Impact

This vulnerability primarily affects file locking mechanisms in Python applications, which may lead to unauthorized access or data corruption in shared environments. While not directly violating GDPR or HIPAA, it could indirectly impact compliance by enabling race conditions that compromise data integrity or confidentiality in systems handling sensitive data.

Mitigation Strategies

Upgrade filelock to version 4.2.1 or later immediately. Use StrictSoftFileLock instead of SoftFileLock if possible. Avoid sticky directories like /tmp for lock files. Monitor filesystem events in /tmp or similar directories for suspicious file creation or deletion patterns.

Hi! I’m here to help you understand CVE-2026-112906. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...