CVE-2026-112906
Description
A flaw was found in filelock. A local attacker can manipulate lock file timestamps when multiple processes are waiting for a lock, causing the SoftFileLock component to misidentify an active lock as expired. As a result, legitimate lock files can be prematurely removed, allowing unauthorized concurrent access to shared resources and compromising data integrity.
Statement
This vulnerability is rated as having a Moderate impact because successful exploitation requires local user access and a narrow race condition involving rapid filesystem inode reuse and predictable coarse clock timestamps. In typical Red Hat environments, applications run under containerized isolation or dedicated service accounts that do not share world-writable lock directories with untrusted local users. Furthermore, standard deployments generally rely on native OS file locking mechanisms rather than software-based locks located in shared temporary locations, significantly limiting exposure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 4.7 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
