The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
GHSA-rfpc-qcw5-3pc4: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
- Identifiers
- CVE-2026-112939GHSA-rfpc-qcw5-3pc4
- Published
- Record updated
- Affected
- filelock >= 3.22.0, <= 4.2.0
- Fixed in
- 4.2.1
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.1%
Summary
The filelock soft-lock classes (SoftFileLock, MarkerSoftFileLock, SoftFileLease, their async variants, and FileLock falling back to a soft lock on ENOSYS) decide whether a lock holder is gone from the PID recorded in the marker file without checking who wrote that record. A local user who can write but not remove the marker can rewrite the holder's PID to a dead one, so a contender of the holder's account or root removes the live marker and acquires the lock, letting two processes run the critical section together. Affected versions are filelock 3.22.0 through 4.2.0 (ANT-2026-W1H9NXUH).
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- filelockPyPINo LLM dependency detected · 42 tracked dependents