AIKIDO-2026-228169

TL;DR

SoftReadWriteLock coordinates readers and writers through on-disk marker files whose ownership is tracked by a per-holder token. On release and during the writer's reader-drain phase the writer marker is unlinked or refreshed by path without re-checking that token, so a holder paused past the stale threshold can have its slot reclaimed by a peer and then delete or keep alive that peer's live marker, admitting a second concurrent writer and breaking mutual exclusion. The heartbeat also refreshes markers by path after opening them, letting a local attacker swap a symlink in between the check and the os.utime touch so the timestamp update lands on an unintended target file. The fix re-verifies the marker token before unlinking or completing an acquire and refreshes markers through the already-verified file descriptor.