The vulnerability in concurrent-ruby (CVE-2026-54906) affects the Concurrent::ReadWriteLock class prior to version 1.3.7. The release_write_lock method lacks a check to confirm that the calling thread actually holds the write lock, enabling a thread to release a write lock held by another thread. This can lead to multiple writers entering their critical sections concurrently, violating synchronization guarantees. Furthermore, the release_read_lock method improperly decrements the read lock counter even when no read lock is held, potentially causing the counter to become negative and triggering Concurrent::ResourceLimitError on subsequent read lock attempts. These issues represent synchronization correctness flaws in the public API. The vulnerability is resolved in version 1.3.7.

The vulnerability can cause synchronization errors in applications using concurrent-ruby's read-write locks. Specifically, it allows a thread to release a write lock held by another thread, potentially leading to concurrent execution of critical sections that should be mutually exclusive. The decrementing of the read lock counter below zero can cause resource limit errors, disrupting normal lock acquisition. The CVSS score is low (2.1), indicating limited impact and complexity of exploitation.

Upgrade concurrent-ruby to version 1.3.7 or later, where this vulnerability is fixed. No other mitigation is indicated or necessary as the fix is available in the official release.