GHSA-5WJR-9356-4WC8
Vulnerability from github – Published: 2026-10-23 20:54 – Updated: 2026-10-23 20:54Summary
On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.
This affects Interval only. Sleep and Timeout are not affected.
Details
In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.
This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.
Impact
This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.
Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
Credits
Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "tokio"
},
"ranges": [
{
"events": [
{
"introduced": "1.54.0"
},
{
"fixed": "1.54.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.54.0"
]
}
],
"aliases": [
"CVE-2026-115567"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-23T20:54:00Z",
"nvd_published_at": "2026-10-23T18:17:21Z",
"severity": "MODERATE"
},
"details": "### Summary\n\nOn the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime\u0027s time driver.\n\nThis affects `Interval` only. `Sleep` and `Timeout` are **not** affected.\n\n### Details\n\nIn Tokio v1.54.0, a race condition between `tokio::time::Interval::poll_tick` (including `.tick().await`) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer\u0027s waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.\n\nThis bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.\n\n### Impact\n\nThis may lead to crashes and use-after-frees in applications using `Interval` on a multi-threaded runtime.\n\nSince this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.\n\n### Credits\n\nThank you to [creepycode](https://github.com/ByteZ1337) and [carabistouille](https://github.com/carabistouflette) for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.",
"id": "GHSA-5wjr-9356-4wc8",
"modified": "2026-10-23T20:54:00Z",
"published": "2026-10-23T20:54:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115567"
},
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/pull/8458"
},
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/pull/8692"
},
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0"
},
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9"
},
{
"type": "PACKAGE",
"url": "https://github.com/tokio-rs/tokio"
},
{
"type": "WEB",
"url": "https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0384.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Tokio: Race condition in `tokio::time::Interval`"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.