diff mbox series

[meta-python,wrynose,7/9] python3-filelock: ignore CVE-2026-112907

Message ID 20261111052938.3691463-8-dkelaiya@cisco.com
State New
Headers show
Series python3-filelock: Security fixes | expand

Commit Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 11, 2026, 5:29 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Analysis:
- The upstream advisory describes a Windows-only denial of service
  caused by an unanswered oplock on a soft-lock marker. [1][2]
- Marker reads and stale-marker removal can exceed the acquisition
  timeout, including in asynchronous and fallback locks on Windows. [1]
- The Wrynose Linux target does not use the affected Windows oplock
  operations. [1][2]
- Mark the CVE as not applicable to the Linux target platform.

Reference:
[1] https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-112907

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
 meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
index 6f52b19272..814fd59eb3 100644
--- a/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
+++ b/meta-python/recipes-devtools/python/python3-filelock_3.25.2.bb
@@ -7,6 +7,8 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=2c6acbdf7bb74caa37512c3a5ca6857b"
 
 CVE_PRODUCT = "tox-dev:filelock"
 
+CVE_STATUS[CVE-2026-112907] = "not-applicable-platform: Windows oplock handling is not used on Linux"
+
 SRC_URI += " file://run-ptest \
     file://CVE-2026-112939.patch \
     file://CVE-2026-112935_p1.patch \