RUSTSEC-2026-0284 Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`
Safe Rust code can trigger double frees or use uninitialized memory in concurrent data structures, potentially leading to crashes or arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- Not needed
- Fix
- None listed
What is RUSTSEC-2026-0284?
RUSTSEC-2026-0284 is an use after free vulnerability in lockfree, published on 26 Aug 2026.
Official description
Two independent soundness problems, both reachable from safe Rust.
Map::into_iter drops builder (the caller-supplied hasher H) and incin by
hand, then commits the ownership transfer with mem::forget(self). H::drop is
user code and may panic. If it does, mem::forget(self) is skipped and the
still-live Map unwinds, whose field drop glue destroys builder a second
time. An empty map is enough — no entries or concurrency required.
SharedIncin::clear writes mem::uninitialized::<Arc<_>>() into self.inner
before taking the real Arc out. Arc has a validity invariant, so this is
undefined behaviour at the point of creation, with no panic or concurrency
involved. Between that write and the repairing one, self.inner also holds
garbage while self is still droppable, so an unwind from incin.clear() or
Arc::new decrements a refcount through an uninitialized pointer. The
make_shared_incin! macro is instantiated five times, so this covers queue,
stack, map, channel::spmc and channel::mpmc.
Impact
- CWE-415 (Double Free): the same allocation is freed twice.
- CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated
Drop. - CWE-908 (Use of Uninitialized Resource): an
Arcis constructed from uninitialized bytes.
Fix
No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.
Which versions are affected by RUSTSEC-2026-0284?
1 open source package ship an affected version, including lockfree.
| Package | Affected | Fixed in |
|---|---|---|
lockfree crates.io | From 0.0.0-0 | None |
How do I fix RUSTSEC-2026-0284?
No fix has been published for RUSTSEC-2026-0284 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is RUSTSEC-2026-0284 being exploited?
There is no known exploitation of RUSTSEC-2026-0284 in the wild and no public exploit code.