CVE-2026-112938

Affected versions of the `filelock` package are vulnerable to Race Condition Enabling Link Following due to checking `<path>.filelock` once with `lstat` and then reaching `<path>.filelock/claims` by pathname. `StrictSoftFileLock` and `AsyncStrictSoftFileLock` pass `O_NOFOLLOW` only for the final `claims` component, so the kernel follows a symbolic link swapped in for `<path>.filelock` after the check. A local attacker who can rename that directory makes the lock user's process create claim directories and files in a directory the attacker chooses, which can leave another strict lock timing out for every process until an operator force-breaks each stranded claim.