SB2026012928 - Anolis OS update for python-filelock

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2025-68146)

The vulnerability allows a local user to truncate arbitrary files.

The vulnerability exists due to a race condition when truncating files. A local user can create a symbolic link to a critical file on the system in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. 

2) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-22701)

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a race condition in the SoftFileLock implementation of the filelock package. A local user can create a symbolic link to a critical file on the system between the permission validation and file creation to cause lock operations to fail or behave unexpectedly.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2026:0095