Time-of-check Time-of-use (TOCTOU) Race Condition in filelock - CVE-2025-68146

Vulnerability identifier: #VU121187

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-68146

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to truncate arbitrary files.

The vulnerability exists due to a race condition when truncating files. A local user can create a symbolic link to a critical file on the system in the time gap between the check and open, causing os.open() to follow the symlink and truncate the target file. 

filelock
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Development Tools Module
SUSE Package Hub 15
Ubuntu
openEuler
Anolis OS
Netezza Appliance
watsonx Code Assistant On Prem
Maximo Application Suite - Monitor Component
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Visual Inspection Component
py3-virtualenv
watsonx.data
IBM Watson Discovery for IBM Cloud Pak for Data
python-filelock (Ubuntu package)
python3-filelock
python3-filelock-doc
python-filelock-help
python-filelock-doc
python-filelock

Install updates from vendor's website.

filelock - update to 3.20.1
Netezza Appliance - update to 1.0.0.1
watsonx.data - update to 2.3.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
watsonx Code Assistant On Prem - update to 5.3.1
Maximo Application Suite - Monitor Component - addressed in versions 8.10.28, 8.11.26, 9.0.18, 9.1.8
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.27, 9.0.19, 9.1.9
Maximo Application Suite - Visual Inspection Component - update to 9.1.10
py3-virtualenv - update to 20.36.0
python-filelock (Ubuntu package) - addressed in versions 3.0.4-1ubuntu0.1~esm1, 3.0.12-2ubuntu0.1~esm1, 3.6.0-1ubuntu0.1~esm1, 3.13.1-1ubuntu0.1~esm1
python3-filelock - update to 3.0.12-150100.3.6.1
python3-filelock - update to 3.13.0-2
python3-filelock-doc - update to 3.13.0-2
python3-filelock - update to 3.13.1-5
python-filelock-help - update to 3.13.1-5
python-filelock-doc - update to 3.13.1-5
python-filelock - update to 3.13.1-5

• https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e
• https://github.com/tox-dev/filelock/pull/461
• https://github.com/tox-dev/filelock/releases/tag/3.20.1
• https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f

• Race condition in filelock
• virtualenv update for filelock
• SUSE update for python-filelock
• IBM Netezza Appliance update for filelock
• Anolis OS update for python-filelock
• Ubuntu update for python-filelock
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• IBM Maximo Application Suite - Visual Inspection Component update for filelock
• IBM Edge Data Collector update for filelock
• IBM watsonx.data update for filelock
• IBM Watson Discovery Cartridge update for filelock
• openEuler update for python-filelock