Skip to content
OpenAdvisories
Unscored RUSTSEC-2026-0274

Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics

Published Aug 4, 2026 · Updated Sep 1, 2026 · Assigned by RUSTSEC

Description

`ReadChunk::commit` and `ReadChunk::commit_all` drop the committed elements
before advancing the consumer head. If an element's `Drop` panics during the
drop loop, `head` is never advanced, so the ring buffer still treats those slots
as holding live elements. When the `RingBuffer` is later dropped (it walks
`head..tail` and drops each slot), or a subsequent `read_chunk()` / `commit()`
touches the same slots, the already-dropped elements are dropped a second time —
a double free (CWE-415) / use-after-free (CWE-416) reachable from safe Rust.

## Mitigation

Update to 0.3.5 (0.3.x line) or 0.4.0. Note that 0.4.0 contains a behavior
change in `is_abandoned()`, so users on 0.3.x should prefer 0.3.5.

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io rtrb >= 0.0.0-0, < 0.3.5 · >= 0.4.0-0, < 0.4.0 0.3.5, 0.4.0 RUSTSEC-2026-0274

References