Race condition in Tokio time Interval can cause use-after-free
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 27 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
The Tokio Rust runtime version 1.54.0 has a race condition (CWE-362) in tokio::time::Interval, where the multi-threaded time driver can drop an internal timer entry without synchronizing with the thread firing it. This causes a use-after-free on the timer's waker and task state in safe Rust. A local user with low privileges could cause assertion panics, task reference-count corruption, or heap memory corruption.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without synchronizing with the driver thread that was firing it. The race caused a use-after-free on the timer's waker and task state in safe Rust, which could produce assertion panics, task reference-count corruption, or heap memory corruption. This issue is fixed in 1.54.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tokio-rs | tokio | = 1.54.0 | — | No fix listed | CNA |
| — | tokio (crates.io) | 1.54.0 to before 1.54.1 | 1.54.1 | Patch available | GHSA-5wjr-9356-4wc8 |
- tokio Vendortokio-rs Affected = 1.54.0 Fixed in — No fix listed CNA
- tokio (crates.io) Vendor— Affected 1.54.0 to before 1.54.1 Fixed in 1.54.1 Patch available GHSA-5wjr-9356-4wc8
Remediation
Upgrade the tokio crate from 1.54.0 to 1.54.1, the version listed as fixed on crates.io. Red Hat lists no fix available yet for Ansible Automation Orchestrator 2026, Confidential Cluster Operator, Confidential Compute Attestation, Lightspeed Services for Advanced Cluster Management, OpenShift Lightspeed and other products, and no fix is planned for Logging Subsystem for Red Hat OpenShift.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · GHSA-5wjr-9356-4wc8 tokio (crates.io) Fixed in 1.54.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
| Confidential Cluster Operator | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Lightspeed Services for Advanced Cluster Management | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux command line assistant | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Update Service | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Hardened Images
Timeline
- 2026-10-23 Threatist record created from CVE-2026-115567
- 2026-10-23 Alias added: GHSA-5wjr-9356-4wc8
- 2026-10-23 Fix available: crates.io/[email protected] · GHSA-5wjr-9356-4wc8
- 2026-10-23 CVSS score added · GHSA-5wjr-9356-4wc8
- 2026-10-23 Weakness changed · GHSA-5wjr-9356-4wc8
- 2026-10-23 9 new references · GHSA-5wjr-9356-4wc8
- 2026-10-24 Priority changed: MEDIUM → LOW
- 2026-10-29 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 8
- https://github.com/tokio-rs/tokio/security/advisories/GHSA-5wjr-9356-4wc8
- https://github.com/tokio-rs/tokio/pull/8458
- https://github.com/tokio-rs/tokio/pull/8692
- https://github.com/tokio-rs/tokio/commit/2b4eba7833864c04ecd2f3e5f4a97ff4f6fa28d0
- https://github.com/tokio-rs/tokio/commit/5ed619bbaba87357ee5103d71b75e7c84cad99c9
- https://github.com/tokio-rs/tokio/releases/tag/tokio-1.54.1
- https://github.com/tokio-rs/tokio
- https://rustsec.org/advisories/RUSTSEC-2026-0384.html
More tokio-rs vulnerabilities
- TI-2024-18146 Mio's tokens for named pipes may be delivered after deregistration CVSS 3.1CRITICAL 9.1
- TI-2026-20650 Bytes is vulnerable to integer overflow in BytesMut::reserve CVSS 4.0MEDIUM 5.5
- TI-2022-02967 DoS in axum-core due to missing request size limit CVSS 3.1HIGH 7.5
- TI-2023-08715 Tokio's reject_remote_clients configuration may get dropped when creating a Windows named pipe CVSS 3.1MEDIUM 5.4
- TI-2025-34841 slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check CVSS 4.0MEDIUM 5.1
- TI-2025-35976 Tracing logging user input may result in poisoning logs with ANSI escape sequences CVSS 4.0LOW 2.3
Sources
- CVE-2026-115567 · CVE Program
- CVE-2026-115567 · NVD
- FIRST EPSS
- GHSA-5wjr-9356-4wc8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-115567 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences