CVE-2026-112935

Affected versions of the `filelock` package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition due to breaking a stale marker on the basis of an earlier observation that no longer holds. `SoftFileLock` judges a marker stale from a saved read and later removes the marker at that name, so a live successor created on a reused inode with a modification time no newer than the saved observation is mistaken for the stale one. A local attacker who frees its own marker right after the stale read can cause an honest contender's live marker to be removed, admitting two holders at once and defeating the mutual exclusion of the lock.