Description
In crossbeam-channel rust crate, the internal `Channel` type's `Drop` method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | crossbeam-channel | 0.5.12 – < 0.5.15 | 0.5.15 |
| Red Hat | Red Hat Directory Server 11 | — | — |
| Red Hat | Red Hat Directory Server 12 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat Satellite 6 | — | — |
| Red Hat | Red Hat Trusted Artifact Signer | — | — |
| Red Hat | Red Hat Trusted Profile Analyzer | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-crossbeam-channel | 0.5.15-1 | — |
| Debian 13 | rust-crossbeam-channel | 0.5.15-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | rust-crossbeam-channel | No fix yet | — |
| Ubuntu 22.04 LTS | rust-crossbeam-channel | No fix yet | — |
| Ubuntu 20.04 LTS | rust-crossbeam-channel | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | cargo-c | 0.10.15-160000.1.1 | SUSE-SU-2026:20096-1 |
| SLES for SAP 16.0 | gstreamer-devtools | 1.26.7-160000.2.1 | SUSE-SU-2026:23572-1 |
| SLES 16.0 | cargo-c | 0.10.15-160000.1.1 | SUSE-SU-2026:20096-1 |
| SLES 16.0 | gstreamer-devtools | 1.26.7-160000.2.1 | SUSE-SU-2026:23572-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cargo-audit | 0.21.2~git0.18e58c2-2.1 | openSUSE-SU-2025:15550-1 |
| openSUSE Tumbleweed | cargo-c | 0.10.3~git0.ee7d7ef-4.1 | openSUSE-SU-2025:15551-1 |
| openSUSE Tumbleweed | python-ruff | 0.16.10-1.1 | openSUSE-SU-2026:12042-1 |
| openSUSE Tumbleweed | zed | 1.24.2-1.1 | openSUSE-SU-2026:12355-1 |
| openSUSE Leap 16.0 | cargo-c | 0.10.15-160000.1.1 | openSUSE-SU-2026:20060-1 |
| openSUSE Leap 16.0 | gstreamer-devtools | 1.26.7-160000.2.1 | openSUSE-SU-2026:21689-1 |
| openSUSE Leap 15.6 | python-maturin | 1.4.0-150600.3.6.1 | SUSE-SU-2025:01591-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | 389-ds-base | No fix yet | — |
| Azure Linux 3 | kata-containers | 3.18.0.kata0-1 | — |
| Azure Linux 3 | kata-containers-cc | 3.15.0.aks0-15 | — |
| Azure Linux 3 | rust | 1.75.0-16 | — |
| Azure Linux 2 (CBL-Mariner) | azl-compliance | 1.0.2-2 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cargo-audit | 0.21.2-r3 | — |
| Wolfi rolling | cargo-c | 0.10.12-r1 | — |
| Wolfi rolling | deno | 2.2.9-r0 | — |
| Wolfi rolling | fd | 10.2.0-r2 | — |
| Wolfi rolling | lychee | 0.18.1-r4 | — |
| Wolfi rolling | nushell +1 | 0.103.0-r4 | — |
| Wolfi rolling | oranda | 0.6.5-r5 | — |
| Wolfi rolling | oxipng | 9.1.4-r1 | — |
| Wolfi rolling | pixi +1 | 0.45.0-r2 | — |
| Wolfi rolling | ruff +1 | 0.11.5-r1 | — |
| Wolfi rolling | rust-analyzer | 20240722-r3 | — |
| Wolfi rolling | samply | 0.13.1-r3 | — |
| Wolfi rolling | starship | 1.22.1-r1 | — |
| Wolfi rolling | wadm | 0.21.0-r2 | — |
| Wolfi rolling | wasmcloud | 1.7.1-r2 | — |
| Wolfi rolling | yara-x | 0.14.0-r2 | — |
| Wolfi rolling | yazi | 25.4.8-r1 | — |
| Wolfi rolling | zed | 0.181.6-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | crossbeam-channel | >= 0.5.12, < 0.5.15 | 0.5.15 | GHSA-pg9f-39pc-qf8g |
| crates.io | crossbeam-channel | >= 0.5.12-0, < 0.5.15 | 0.5.15 | RUSTSEC-2025-0024 |
Advisories 9
- openSUSE-SU-2026:12355-1 zed-1.24.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 31, 2026
- openSUSE-SU-2026:12042-1 python313-ruff-0.16.10-1.1 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- SUSE-SU-2026:23572-1 Security update for gstreamer-devtools SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:21689-1 Security update for gstreamer-devtools SUSE / openSUSE Security Updates · Aug 31, 2026
- openSUSE-SU-2026:20060-1 Security update for cargo-c SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15550-1 cargo-audit-0.21.2~git0.18e58c2-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15551-1 cargo-c-0.10.3~git0.ee7d7ef-4.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20096-1 Security update for cargo-c SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01591-1 Security update for python-maturin SUSE / openSUSE Security Updates · Feb 4, 2026