Live › vulnerability › CVE-2026-115567
Go to dashboardTokio's tokio::time::Interval has a race condition with the runtime time driver on the multi-threaded runtime, which can drop a timer entry and cause a use-after-free in safe Rust. An attacker gets crashes or heap memory corruption in applications that use Interval, and the advisory does not describe a code execution path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC, 1h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| tokio | cargo | = 1.54.0 | 1.54.1 |
1.54.0 in Cargo.lockUpgrade tokio to 1.54.1 or later, which fixes this issue.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.
This affects Interval only. Sleep and Timeout are not affected.
In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.
This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.
This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.
Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
This page as .md · .json · in your agent: get_signal("CVE-2026-115567")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.