{"id":"CVE-2026-115567","kind":"vulnerability","aliases":["CVE-2026-115567","GHSA-5wjr-9356-4wc8"],"related":[],"title":"Tokio: Race condition in `tokio::time::Interval`","description":"### Summary\n\nOn the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.\n\nThis affects `Interval` only. `Sleep` and `Timeout` are **not** affected.\n\n### Details\n\nIn Tokio v1.54.0, a race condition between `tokio::time::Interval::poll_tick` (including `.tick().await`) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.\n\nThis bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.\n\n### Impact\n\nThis may lead to crashes and use-after-frees in applications using `Interval` on a multi-threaded runtime.\n\nSince this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.\n\n### Credits\n\nThank you to [creepycode](https://github.com/ByteZ1337) and [carabistouille](https://github.com/carabistouflette) for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.","summary":"Tokio's tokio::time::Interval has a race condition with the runtime time driver on the multi-threaded runtime, which can drop a timer entry and cause a use-after-free in safe Rust. An attacker gets crashes or heap memory corruption in applications that use Interval, and the advisory does not describe a code execution path.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"tokio","fixed":["1.54.1"],"affected":"= 1.54.0","ecosystem":"cargo"}],"ecosystems":["cargo"],"tags":["cargo","cwe-362","package","rust","tokio"],"not_affected_if":["not-on-1.54.0","sleep-or-timeout-only"],"how_to_check":"Run cargo tree -i tokio and check whether the resolved version is 1.54.0 in Cargo.lock.\nSearch the codebase for tokio::time::Interval, .tick().await, or interval( calls on the multi-threaded runtime.","fix":"Upgrade tokio to 1.54.1 or later, which fixes this issue.","status":"open","published_at":"2026-10-23T18:17:21+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:31+00:00","updated_at":"2026-10-23T21:57:34+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:00:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade tokio to 1.54.1 or later, which fixes this issue.\nunknown","reach":"unknown","impact":"medium","summary":"Tokio's tokio::time::Interval has a race condition with the runtime time driver on the multi-threaded runtime, which can drop a timer entry and cause a use-after-free in safe Rust. An attacker gets crashes or heap memory corruption in applications that use Interval, and the advisory does not describe a code execution path.","category":"package","who_cares":["rust","tokio","cargo"],"confidence":0.8,"needs_auth":"no","worst_case":"Heap memory corruption and crashes in applications using Interval","analyst_note":"","how_to_check":"Run cargo tree -i tokio and check whether the resolved version is 1.54.0 in Cargo.lock.\nSearch the codebase for tokio::time::Interval, .tick().await, or interval( calls on the multi-threaded runtime.\nunknown","needs_analyst":false,"not_affected_if":["sleep-or-timeout-only","not-on-1.54.0"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000522,"input_tokens":3160,"output_tokens":412,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115567':10A,19A '-2026':9A,18A '-362':23B '-4':15A '/bytez1337)':253C '/carabistouflette)':258C '/tokio-rs/tokio/pull/8458,':196C '/tokio-rs/tokio/pull/8692.':204C '5wjr':13A '9356':14A 'advisori':78B 'affect':109C,117C 'applic':72B,217C 'assert':178C 'attack':64B 'await':133C 'bug':190C 'carabistouill':255C 'cargo':21B 'caus':54B,156C 'code':83B 'condit':3A,35B,97C,124C 'corrupt':70B,184C,188C 'count':183C 'crash':66B,210C,234C 'credit':246C 'creepycod':250C 'cve':8A,17A 'cwe':22B 'data':158C 'describ':81B 'detail':118C 'driver':40B,107C,138C,149C 'drop':49B,140C 'entri':52B,144C 'execut':84B 'fire':153C 'fix':200C 'free':59B,164C,215C 'get':65B 'ghsa':12A 'ghsa-5wjr':11A 'github.com':195C,203C,252C,257C 'github.com/bytez1337)':251C 'github.com/carabistouflette)':256C 'github.com/tokio-rs/tokio/pull/8458,':194C 'github.com/tokio-rs/tokio/pull/8692.':202C 'heap':68B,186C 'impact':205C 'includ':131C 'independ':276C 'intern':142C 'interv':7A,31B,75B,99C,110C,128C,219C 'introduc':192C 'issu':228C,275C 'known':230C 'lead':176C,208C,232C 'may':207C 'memori':69B,187C 'multi':44B,90C,223C 'multi-thread':43B,89C,222C 'outlin':266C 'packag':24B 'panic':179C 'path':85B 'polici':270C 'poll':100C,129C 'privat':262C 'procedur':265C 'product':236C 'race':2A,34B,96C,123C,159C 'refer':182C 'reference-count':181C 'releas':240C 'report':260C,273C 'runtim':38B,46B,92C,104C,136C,225C 'rust':25B,62B,175C 'safe':61B,174C 'secur':269C 'sinc':226C 'sleep':112C 'state':172C 'summari':86C 'synchron':146C 'system':237C 'task':171C,180C 'thank':247C 'thread':45B,91C,150C,224C 'tick':101C,130C,132C 'time':6A,30B,39B,106C,127C,137C 'timeout':114C 'timer':51B,143C,167C 'tokio':1A,5A,20A,26B,27B,29B,120C,126C,242C 'use':57B,74B,162C,213C,218C,263C 'use-after-fre':56B,161C,212C 'v1.54.0':121C,239C 'waker':169C 'wc8':16A 'without':145C 'yank':245C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T18:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-5wjr-9356-4wc8","url":"https://github.com/advisories/GHSA-5wjr-9356-4wc8","severity":"medium","published_at":"2026-10-23T20:54:00+00:00","modified_at":"2026-10-23T20:54:01+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-115567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115567","severity":null,"published_at":"2026-10-23T18:17:21+00:00","modified_at":"2026-10-23T19:42:24+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}