CVE-2026-112906: Mutual Exclusion Bypass via Inode Recycling and Time Tracking Race in filelock

Vulnerability ID: CVE-2026-112906
CVSS Score: 4.7
Published: 2026-10-23

A local race condition and mutual exclusion bypass vulnerability exists in filelock versions 4.1.0 through 4.2.0. On Linux filesystems with rapid inode reuse, a local attacker can manipulate modification timestamps and lock files to cause waiting processes to falsely evict active soft lock markers.

TL;DR

filelock versions 4.1.0-4.2.0 track stale locks using a tuple of inode number and modification time. An attacker can manipulate these properties on shared filesystems to trick waiters into deleting live locks, causing concurrent critical section access.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability ID: CVE-2026-112906 / GHSA-2g95-wg33-c5x2
• Weakness Enumeration: CWE-694 (Duplicate Identifier / Inode Race)
• CVSS v3.1 Score: 4.7 (Medium)
• EPSS Score: 0.00205 (10.01th percentile)
• CISA KEV Status: Not Listed
• Exploit Maturity: Proof of Concept / Test Suite
• Impact: Mutual Exclusion Bypass / Critical Section Race Condition

Affected Systems

• Python environments utilizing filelock versions 4.1.0 through 4.2.0 on POSIX filesystems with active soft file locking
• filelock: >= 4.1.0, < 4.2.1 (Fixed in: 4.2.1)

Code Analysis

Commit: 740ff66

Fix stale lock detection race condition by including ctime, implementing inode pinning, and enforcing atomic name exchanges.

Exploit Details

• GitHub Fix Commit Test Suite: Reproduction test case added directly to the filelock repository verifying stale lock eviction race dynamics.

Mitigation Strategies

• Upgrade filelock to version 4.2.1 or higher.
• Isolate application lock directories inside private user folders with restricted 0700 permissions.
• Avoid world-writable shared directories like /tmp for synchronization files.

Remediation Steps:

1. Run 'pip install --upgrade filelock' to update the dependency to 4.2.1+.
2. Verify the active version in Python using 'import filelock; print(filelock.version)'.
3. Audit codebases for explicit usage of SoftFileLock in multi-tenant or shared environments.

References

• GitHub Security Advisory GHSA-2g95-wg33-c5x2
• Fix Commit 740ff666b62a88496c8d7394e4e6230605e4d62b
• Upstream Pull Request #843
• filelock v4.2.1 Release Notes
• NVD Vulnerability Detail CVE-2026-112906
• CVE Program Record CVE-2026-112906

Read the full report for CVE-2026-112906 on our website for more details including interactive diagrams and full exploit analysis.