AIKIDO-2026-867998

TL;DR

When SoftFileLock or SoftReadWriteLock uses a writable shared lock directory, stale-lock breaking followed symlinks or stale mtimes and could delete a live lock or leave two holders active. A same-UID peer could also place a FIFO at a predictable read/write marker path to block lock operations indefinitely, and is_lock_held_by_us could treat another host's same-PID lock as owned locally. Attacker-controlled lock-file PIDs outside the valid range could prevent stale-lock recovery or abort acquisition with an uncaught error. The fix uses lstat, atomic rename-and-recheck breaking, non-blocking marker opens, hostname-aware holder checks, and strict PID range validation during self-heal.