SB2026020427 - Ubuntu update for python-filelock 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026020427

SB2026020427 - Ubuntu update for python-filelock

Published: February 4, 2026

Security Bulletin ID SB2026020427
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-22701)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a race condition in the SoftFileLock implementation of the filelock package. A local user can create a symbolic link to a critical file on the system between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.


2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2025-68146)

The vulnerability allows a local user to truncate arbitrary files.

The vulnerability exists due to a race condition when truncating files. A local user can create a symbolic link to a critical file on the system in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. 


Remediation

Install update from vendor's website.

References