The vulnerabilities in python-filelock involve TOCTOU race conditions that can be exploited by local attackers to corrupt or truncate arbitrary user files. CVE-2025-68146 refers to a general TOCTOU race condition in python-filelock, while CVE-2026-22701 specifically affects the SoftFileLock implementation. These race conditions occur when the state of a file is checked and then used without proper synchronization, allowing an attacker to intervene between these operations. The issues were reported by the SUSE Product Security Team and are addressed in a security update. No CVSS score is provided, and no explicit affected versions or patch links are stated in the provided data.

Local attackers may exploit these TOCTOU race conditions to corrupt or truncate arbitrary user files, potentially leading to data loss or integrity issues. There is no indication of remote exploitation or privilege escalation. No known exploits in the wild have been reported.

A security update has been released to fix these vulnerabilities. Users should apply the update provided by their vendor or distribution to mitigate the risk. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the SUSE Product Security Team advisories for the official patch and remediation instructions.