filelock CVE-2026-112906

Exploitation is confined to filelock's SoftFileLock/MarkerSoftFileLock/SoftFileLease classes (versions 4.1.0 through 4.2.0); the default FileLock using OS-level flock is not affected, so a deployment is only at risk when the soft/marker lock implementation is explicitly used or fallen back to. The attacker must already run a local process contending on the same lock path, and ALL of the following must coincide: the attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the stale observation, and an honest contender creates a fresh marker on the reused inode (ext4's freed-inode reuse is the enabling filesystem behavior). These conjunctive race conditions - plus the lack of any remote vector and no user interaction by the victim beyond normal lock contention - sharply limit realistic exploitation to co-located, timing-controlled scenarios.

This is a genuinely low-priority issue despite the HIGH integrity impact, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) describes a local, high-complexity attack requiring an already-present low-privilege process - not a remotely reachable flaw - which caps the base score at 4.7 (Medium). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so by the precision rules this is 'no public exploit identified at time of analysis.' The AC:H rating is strongly justified by the description: successful exploitation requires a narrow race window plus four simultaneous preconditions (attacker pre-dates and removes its own marker, at least two lock-user processes waiting, coarse/matching modification times, and an honest contender landing a fresh marker on the reused inode). The absence of EPSS/KEV/POC combined with AC:H indicates this is a reliability/correctness defect in a concurrency primitive rather than a weaponizable security bug; real-world abuse would require an attacker to already have local code execution contending on the same lock path. One metadata conflict to flag: the input Tags include 'Information Disclosure', but the CVSS vector sets C:N and I:H - the impact is loss of mutual-exclusion integrity (a live holder's lock marker is removed), not disclosure of information; treat the 'Information Disclosure' categorization as incorrect.

On a shared host, an attacker-controlled process participates in filelock's SoftFileLock contention on the same lock path as a victim process. By pre-dating and then removing its own marker so a stale observation survives on a reused inode, the attacker causes an honest contender's exchange to delete the live holder's marker, so two processes simultaneously believe they hold the lock and corrupt the resource the lock was meant to protect. No public exploit code was provided, and the required race plus multiple preconditions make reliable triggering difficult.