Race Condition in filelock Leads to File Lock Bypass

Executive Summary

CVE-2026-112935 is a race condition vulnerability in the filelock library versions 3.22.0 to 4.2.0. It allows two processes to hold the same lock simultaneously under specific conditions. An attacker with local access can exploit this by creating a stale lock file with a future modification time, forcing the lock to be released prematurely. When the inode number is reused by the filesystem, another process can acquire the lock without detection.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses filelock library versions 3.22.0 to 4.2.0. Run: pip show filelock or pip list | grep filelock to verify the installed version. Inspect lock files in sticky directories like /tmp for unexpected lock file behavior or premature lock releases.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to high integrity loss. Two processes may write to protected data simultaneously without awareness of each other, causing data corruption or inconsistencies. This requires a sticky shared directory, filesystem support for inode reuse, and at least two contending processes.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the filelock library to version 4.2.1 or later. Use pip install --upgrade filelock. Ensure no processes rely on the vulnerable versions. Review lock file handling in applications using filelock, especially in shared directories with sticky bits.

Useful 0 Not Useful 0