CVE-2026-115567: 
Rust vulnerability analysis and mitigation

CVE-2026-115567 is a race condition vulnerability in the Tokio asynchronous runtime for Rust, specifically affecting tokio::time::Interval on the multi-threaded runtime. In Tokio version 1.54.0, a race between Interval::poll_tick (including .tick().await) and the runtime's time driver can drop an internal timer entry without synchronizing with the driver thread, causing a use-after-free on the timer's waker and task state in safe Rust. Only Interval is affected; Sleep and Timeout are not. The vulnerability was disclosed on October 23, 2026, and has a CVSS v4.0 base score of 5.8 (Medium) (GitHub Advisory, Feedly).

The root cause is a race condition (CWE-362) introduced by PR #8458, which removed the Drop implementations from TimerEntry and time_alt::Timer. This caused Sleep::reset_without_timer to drop elapsed timer entries without synchronizing with the timer driver thread. Specifically, StateCell::fire marks the timer as deregistered before taking its waker, so a concurrent Interval::poll_tick can drop or overwrite the entry while the driver is still accessing it — resulting in a data race and use-after-free (CWE-416) on the timer's waker and task state, even within safe Rust code. The bug manifests during normal operation of any multi-threaded Tokio application using tokio::time::Interval, requiring no special privileges or crafted input (GitHub Advisory, Fix PR #8692).

Exploitation of this vulnerability can lead to assertion panics, task reference-count corruption, or heap memory corruption in affected applications. Because the race occurs during normal runtime operation, any application using tokio::time::Interval on a multi-threaded Tokio 1.54.0 runtime is at risk of crashes or undefined behavior without any attacker interaction. In the worst case, heap memory corruption could theoretically enable arbitrary code execution, though the primary observed impact is application crashes; the issue was confirmed to cause crashes in production systems, which led to the yanking of the 1.54.0 release from crates.io (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is triggered by normal application behavior (using tokio::time::Interval on a multi-threaded runtime) rather than by a crafted external attack, meaning any affected application can encounter the race condition without adversarial input. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The bug was independently reported by two researchers (creepycode/ByteZ1337 and carabistouille/carabistouflette) via responsible disclosure (GitHub Advisory, Feedly).

The primary remediation is to upgrade Tokio to version 1.54.1, which reverts the problematic PR #8458 and restores proper Drop synchronization for timer entries. Tokio 1.54.0 has been yanked from crates.io, so dependency resolution should automatically prefer 1.54.1 or later. If an immediate upgrade is not possible, workarounds include avoiding tokio::time::Interval::poll_tick and .tick().await in applications using the multi-threaded runtime, or switching to the single-threaded runtime mode (GitHub Advisory, Fix PR #8692, Tokio 1.54.1 Release).

The Tokio maintainers responded quickly, yanking version 1.54.0 from crates.io and releasing the patched 1.54.1 within two days of the advisory. The vulnerability was tracked as RUSTSEC-2026-0384 in the Rust Security Advisory Database, prompting widespread automated dependency update PRs across numerous open-source Rust projects. Community reaction was largely focused on rapid remediation, with many projects pinning to 1.53.x as a temporary measure before 1.54.1 became available (GitHub Advisory, Fix PR #8692).