Tokio: Race condition in `tokio::time::Interval`
Impact
Tokio 1.54.0 has a race condition in `tokio::time::Interval` that can cause use-after-free, leading to assertion panics or memory corruption. The issue occurs between the `poll_tick` method and the multi-threaded runtime's time driver. Access to the affected version is required to exploit the weakness.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
tokio-rs · GitHub_M
tokio
1 range
tokio-rs · GitHub_M
tokio
Compare with this publisher’s ranges. This does not inspect your installation.
affected
= 1.54.0
Other versions: unknown
Original source description
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-115567View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.