Race Condition in Tokio Runtime for Rust Applications
CVE-2026-115567

5.8MEDIUM

Key Information:

Vendor

Tokio-rs

Status
Tokio
Vendor
CVE Published:
23 October 2026

What is CVE-2026-115567?

A race condition in version 1.54.0 of the Tokio runtime for Rust causes potential instability due to improper synchronization between the timer's polling mechanism and the multi-threaded time driver. This can lead to a use-after-free error on the timer's waker and task state, which may result in assertion panics, corrupted task references, or even heap memory corruption. This vulnerability has been addressed in the subsequent release, 1.54.1.

Affected Version(s)

tokio = 1.54.0

References

https://github.com/tokio-rs/tokio/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/tokio-rs/tokio/pull/8458
x_refsource_MISC
https://github.com/tokio-rs/tokio/pull/8692
x_refsource_MISC

CVSS V4

Score:
5.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.