{"id":"RUSTSEC-2026-0284","summary":"Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`","details":"Two independent soundness problems, both reachable from safe Rust.\n\n`Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by\nhand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is\nuser code and may panic. If it does, `mem::forget(self)` is skipped and the\nstill-live `Map` unwinds, whose field drop glue destroys `builder` a second\ntime. An empty map is enough — no entries or concurrency required.\n\n`SharedIncin::clear` writes `mem::uninitialized::\u003cArc\u003c_\u003e\u003e()` into `self.inner`\nbefore taking the real `Arc` out. `Arc` has a validity invariant, so this is\nundefined behaviour at the point of creation, with no panic or concurrency\ninvolved. Between that write and the repairing one, `self.inner` also holds\ngarbage while `self` is still droppable, so an unwind from `incin.clear()` or\n`Arc::new` decrements a refcount through an uninitialized pointer. The\n`make_shared_incin!` macro is instantiated five times, so this covers `queue`,\n`stack`, `map`, `channel::spmc` and `channel::mpmc`.\n\n## Impact\n\n* CWE-415 (Double Free): the same allocation is freed twice.\n* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.\n* CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes.\n\n## Fix\n\nNo fixed release is available. The crate has had no release since 2018-11-18 and\nthe maintainer has not responded to the report.","modified":"2026-09-14T10:00:03.017665783Z","published":"2026-08-26T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/lockfree"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0284.html"},{"type":"REPORT","url":"https://gitlab.com/bzim/lockfree/-/issues/7"}],"affected":[{"package":{"name":"lockfree","ecosystem":"crates.io","purl":"pkg:cargo/lockfree"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}],"ecosystem_specific":{"affects":{"os":[],"functions":["lockfree::channel::mpmc::SharedIncin::clear","lockfree::channel::spmc::SharedIncin::clear","lockfree::map::Map::into_iter","lockfree::map::SharedIncin::clear","lockfree::queue::SharedIncin::clear","lockfree::stack::SharedIncin::clear"],"arch":[]},"affected_functions":null},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0284.json","categories":["memory-corruption"],"cvss":null,"informational":"unsound"}}],"schema_version":"1.9.0"}