filelock EUVD-2026-105029

Requires local access from an account that can modify or rename the soft lock marker file - the holder's own account or root - because pre-4.2.1 markers carried group/other write bits; only SoftFileLock, MarkerSoftFileLock, and SoftFileLease are affected, not the default OS-level FileLock. Realistic exploitation further depends on specific Linux conditions enumerated in the fix: holder and contender running in time namespaces with different boottime offsets (Linux 5.6+), one side unable to read /proc/sys/kernel/random/boot_id (e.g. systemd ProcSubset=pid), or an attacker directly rewriting the marker. Limiting factors: local-only access (no remote vector), need for a writable shared marker, high attack complexity, and dependence on these non-default namespace/boot-id configurations.

This is a genuine but narrowly-scoped, lower-priority issue rather than a drop-everything emergency. The provided CVSS:3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, base 4.7 Medium) is internally consistent with the description: exploitation is local (AV:L), requires an account on the host able to modify the marker (PR:L - an authorized contender such as another process of the holder's account or root), and is high-complexity (AC:H) because it depends on specific Linux conditions (time namespaces with differing boottime offsets, or inability to read the boot id, or actively rewriting the marker). Impact is integrity-only (C:N/I:H/A:N) - the attacker breaks mutual exclusion by evicting a live holder and admitting another, not reading data. No EPSS score, KEV listing, POC, or SSVC decision was provided in the input, so exploitation-probability signals are simply ABSENT (not low - unmeasured). There are no conflicting signals among the sources; the main data gap is the lack of any exploitation-likelihood metric. Net: a local, authenticated, high-complexity confused-deputy flaw with integrity-only consequences - real for shared-account/multi-tenant hosts and CI, but not broadly or remotely exploitable.

On a host where multiple processes share an account (or where root participates) and use filelock's SoftFileLock, an attacker-controlled process rewrites the lock marker - which before the fix carried group/other write bits - to carry a forged process identifier. A contending process's stale check then trusts the forged PID (aided by a boot-id or time-namespace gap), concludes the live holder is dead, removes its marker, and admits a competing holder, breaking the lock and risking concurrent access or data corruption. No public exploit code was identified at time of analysis.