RUSTSEC-2026-0284

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0284

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0284.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0284

Published

2026-08-26T12:00:00Z

Modified

2026-09-14T10:00:03Z

Summary

Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`

Details

Two independent soundness problems, both reachable from safe Rust.

Map::into_iter drops builder (the caller-supplied hasher H) and incin by hand, then commits the ownership transfer with mem::forget(self). H::drop is user code and may panic. If it does, mem::forget(self) is skipped and the still-live Map unwinds, whose field drop glue destroys builder a second time. An empty map is enough — no entries or concurrency required.

SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner before taking the real Arc out. Arc has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, self.inner also holds garbage while self is still droppable, so an unwind from incin.clear() or Arc::new decrements a refcount through an uninitialized pointer. The make_shared_incin! macro is instantiated five times, so this covers queue, stack, map, channel::spmc and channel::mpmc.

Impact

CWE-415 (Double Free): the same allocation is freed twice.
CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated Drop.
CWE-908 (Use of Uninitialized Resource): an Arc is constructed from uninitialized bytes.

Fix

No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / lockfree

Package

Name: lockfree; View open source insights on deps.dev
Purl: pkg:cargo/lockfree

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "lockfree::channel::mpmc::SharedIncin::clear",
            "lockfree::channel::spmc::SharedIncin::clear",
            "lockfree::map::Map::into_iter",
            "lockfree::map::SharedIncin::clear",
            "lockfree::queue::SharedIncin::clear",
            "lockfree::stack::SharedIncin::clear"
        ],
        "os": []
    }
}