CVE-2026-112908

This vulnerability is rated as Moderate impact because successful exploitation requires local unprivileged access alongside non-standard environmental configurations, such as an overly permissive umask or inherited default ACLs that grant write permissions to unauthorized users. On standard Red Hat Enterprise Linux deployments, the default system umask of 022 prevents arbitrary local users from deleting or modifying files within another user's lock directory. Consequently, unauthorized lock release, premature entry into critical sections, or denial-of-service conditions are restricted to shared multi-user setups with relaxed permission masks.

Configure processes that employ filelock to run with a restrictive umask (such as 022 or 027) and store lock files in dedicated, user-owned directories rather than shared world-writable directories such as /tmp. Additionally, verify that parent directories do not enforce default POSIX ACLs that grant write permissions to other users or groups.

To apply a restrictive umask to an application process or session:

```bash

umask 027

```

To remove group and world write permissions on existing lock coordination trees:

```bash

find /path/to/locks -maxdepth 2 -type d -name '*.filelock' -exec chmod -R go-w {} +

```

Enforcing restrictive umasks or removing write permissions will prevent legitimate cross-account lock sharing if an application intentionally relies on group-writable coordination files. Permission modifications should be executed while associated workloads are idle to avoid disrupting active synchronization.