mbox series

[meta-python,wrynose,0/9] python3-filelock: Security fixes

Message ID 20261111052938.3691463-1-dkelaiya@cisco.com
Headers show
Series python3-filelock: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 11, 2026, 5:29 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport six filelock security fixes to the 3.25.2 recipe on Wrynose.
Record three Windows-only CVEs as not applicable to the Linux target.

The fixes cover soft-lock marker permissions, atomic stale-marker
takeover, UnixFileLock integrity, ReadWriteLock symlink handling,
bounded SQLite schema work, and private SQLite database and side-file
names in shared directories.

Include the upstream recovery-PID, raced-restoration, ENOSYS ownership,
descriptor-test, WAL-header and inherited-ACL corrections with their
corresponding fixes. Retain the 3.25.2 public API and persistent
ReadWriteLock connections.

The final three patches set CVE_STATUS for CVE-2026-112907,
CVE-2026-112910 and CVE-2026-112913, which affect Windows oplock,
permission and SQLite side-file handling.

Darsh Kelaiya (9):
  python3-filelock: fix CVE-2026-112939
  python3-filelock: fix CVE-2026-112935
  python3-filelock: fix CVE-2026-112909
  python3-filelock: fix CVE-2026-112936
  python3-filelock: fix CVE-2026-112915
  python3-filelock: fix CVE-2026-112940
  python3-filelock: ignore CVE-2026-112907
  python3-filelock: ignore CVE-2026-112910
  python3-filelock: ignore CVE-2026-112913

 .../python3-filelock/CVE-2026-112909_p1.patch      | 312 +++++++
 .../python3-filelock/CVE-2026-112909_p2.patch      |  53 ++
 .../python/python3-filelock/CVE-2026-112915.patch  | 280 ++++++
 .../python3-filelock/CVE-2026-112935_p1.patch      | 945 +++++++++++++++++++++
 .../python3-filelock/CVE-2026-112935_p2.patch      |  90 ++
 .../python3-filelock/CVE-2026-112935_p3.patch      | 425 +++++++++
 .../python/python3-filelock/CVE-2026-112936.patch  | 382 +++++++++
 .../python/python3-filelock/CVE-2026-112939.patch  | 107 +++
 .../python3-filelock/CVE-2026-112940_p1.patch      | 699 +++++++++++++++
 .../python3-filelock/CVE-2026-112940_p2.patch      | 104 +++
 .../python/python3-filelock_3.25.2.bb              |  20 +-
 11 files changed, 3416 insertions(+), 1 deletion(-)
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112909_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112909_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112915.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112935_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112935_p2.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112935_p3.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112936.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112939.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112940_p1.patch
 create mode 100644 meta-python/recipes-devtools/python/python3-filelock/CVE-2026-112940_p2.patch