CVE-2026-112934
Description
A flaw was found in filelock. A local user with rename permissions in the lock directory can cause a Denial of Service (DoS) by replacing lock holder records with a named pipe, causing locking operations to stall indefinitely. Under permissive file system policies, an attacker can also link target files to trick the locking process into unintentionally overwriting data. This issue occurs because the lock mechanism refreshes holder records by file name without safely validating file attributes.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires local access to a shared directory and cannot be triggered remotely. On standard Red Hat enterprise environments, kernel security controls such as protected hardlinks mitigate unauthorized file corruption by default, restricting the primary threat to local denial of service via stalled lock operations. Furthermore, the issue only affects applications utilizing the soft read-write lock implementation in locations accessible to untrusted local users.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | 6.1 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
