Medium [CVE-2026-54905] Incorrect write lock granting leading to broken mutual exclusion

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReentrantReadWriteLock can incorrectly grant a write lock after one thread acquires the read lock 32,768 times.

The lock stores a thread's local read and write hold counts in one integer. The low 15 bits are used for the read hold count, and bit 15 is used as WRITE_LOCK_HELD.

This breaks the core mutual-exclusion guarantee: the caller is told it has a write lock, but other threads can still hold or acquire read locks at the same time. This vulnerability is fixed in 1.3.7.

This occurs when a thread acquires a read lock 32,768 times, causing an internal counter to incorrectly indicate a write lock is held. This breaks the fundamental mutual-exclusion guarantee of the lock, potentially leading to unexpected behavior or data corruption due to concurrent access.

Red Hat rates this flaw as Low impact, consistent with the upstream CVEORG assessment (2.0). The vulnerability requires a single thread to acquire the same ReentrantReadWriteLock read lock 32,768 times reentrantly before the internal counter overflows into the write-lock bit.

This precondition does not arise in normal application usage. While concurrent-ruby ships the vulnerable lock class in Red Hat products, no transitive dependency was confirmed to instantiate ReentrantReadWriteLock.