RUSTSEC-2026-0386

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0386

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0386.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0386

Published

2026-10-13T12:00:00Z

Modified

2026-10-23T14:45:03Z

Summary

`AsyncFd::new` and related constructors violate I/O safety

Details

tokio::io::unix::AsyncFd provides safe constructors (new, with_interest, try_new, and try_with_interest) that accept any T: AsRawFd rather than requiring proof of ownership or validity of the file descriptor. Because RawFd implements AsRawFd, safe code can construct an AsyncFd from an arbitrary or closed file descriptor, or close/replace the underlying file descriptor while the AsyncFd is still alive.

This violates I/O safety in two ways:

AsyncFd<T> implements AsFd for all T: AsRawFd by calling BorrowedFd::borrow_raw(self.as_raw_fd()), allowing safe code to obtain an arbitrary BorrowedFd<'_> without owning the file descriptor.
Tokio's I/O driver stores a pointer to an internal allocation in the epoll/kqueue user data for registered file descriptors. If the underlying file descriptor is duplicated and then closed while an AsyncFd is alive, and the OS reuses that file descriptor number for a another IO resource on the same runtime, dropping the first AsyncFd deregisters the reused file descriptor number and frees the first while the original file description remains registered in epoll, leading to a use-after-free when a readiness event fires.

Starting in Tokio 1.51.6, 1.53.3, and 1.54.0, AsyncFd::new, AsyncFd::with_interest, AsyncFd::try_new, and AsyncFd::try_with_interest are deprecated in favor of the unsafe constructors AsyncFd::register and AsyncFd::register_with_interest. Callers must ensure that the file descriptor remains valid, open, and unchanged for the lifetime of the AsyncFd.

Database specific

{
    "license":  "CC0-1.0"
}

References

Affected packages

crates.io / tokio

Package

Name: tokio; View open source insights on deps.dev
Purl: pkg:cargo/tokio

Affected ranges

Type: SEMVER
Events: Introduced

0.3.2

Fixed

1.51.6

Introduced

1.52.0

Fixed

1.53.3

Ecosystem specific

{
    "affected_functions":  null,
    "affects":  {
        "arch":  [],
        "functions":  [
            "tokio::io::unix::AsyncFd::new",
            "tokio::io::unix::AsyncFd::try_new",
            "tokio::io::unix::AsyncFd::try_with_interest",
            "tokio::io::unix::AsyncFd::with_interest"
        ],
        "os":  []
    }
}