CVE-2026-112906

What it actually does

Race condition in SoftFileLock (4.1.0-4.2.0) permits reuse of a stale inode observation when an attacker pre-dates/removes its marker, at least two lock contenders are waiting, modification times match or are coarse, and an honest process creates a fresh marker; the live marker is then incorrectly deleted as stale, violating the lock invariant.

Why it matters to the business

Applications relying on file-based mutual exclusion in Python may experience concurrent access to shared files, increasing risk of data corruption or inconsistent state in multi-process workloads; the issue affects a widely used library but has seen no public exploitation in the six days since disclosure.

How an attack unfolds

An attacker prepares a stale lock marker with an old timestamp on the target inode, removes it after observation, and waits for two or more honest processes to contend; when one creates a fresh marker the attacker forces the library to classify the new marker as stale and delete it, allowing the attacker to acquire the lock or bypass serialization.

How to fix it

Upgrade the filelock package to version 4.2.1 or later in all environments; verify the installed version with 'pip show filelock' and update requirements or lockfiles accordingly.

How to confirm the fix worked

Confirm the package version is 4.2.1 or newer; re-run any existing file-locking unit tests under concurrent load and monitor for unexpected concurrent access after the upgrade.

Typical attack path

1. Create and timestamp a lock marker file on the target inode
2. Remove the marker after an observation window
3. Trigger contention among at least two lock-using processes
4. Force reuse of the stale observation via matching modification times
5. Delete the newly created live marker as stale

How to detect it

Review application logs for repeated lock-acquisition failures or unexpected concurrent file writes; correlate with process start times and inode timestamps on lock files; no public exploit artifacts are known.

What your security team should do

• Immediately upgrade filelock to 4.2.1 across development, staging, and production
• Inventory all Python projects and containers that declare filelock as a dependency
• Add a dependency version constraint (>=4.2.1) to prevent regression
• Review any custom SoftFileLock usage for additional hardening opportunities