On the multi-threaded runtime, there is a race condition between Interval::poll_tick and the runtime's time driver.
This affects Interval only. Sleep and Timeout are not affected.
Details
In Tokio v1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.
This may lead to crashes and use-after-frees in applications using Interval on a multi-threaded runtime.
Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
Credits
Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
> Race condition in `tokio::time::Interval` on Tokio v1.54.0
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `tokio` |
| Version | `1.54.0` |
| URL | [https://github.com/tokio-rs/tokio/pull/8692](https://github.com/tokio-rs/tokio/pull/8692) |
| Date | 2026-10-21 |
| Patched versions | `>=1.54.1` |
| Unaffected versions | `<1.54.0` |
## Summary
On the multi-threaded runtime, there is a race condition between `Interval::poll_tick` and the runtime's time driver.
This affects `Interval` only. `Sleep` and `Timeout` are **not** affected.
## Details
In Tokio v1.54.0, a race condition between `tokio::time::Interval::poll_tick` (including `.tick().await`) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.
This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.
## Impact
This may lead to crashes and use-after-frees in applications using `Interval` on a multi-threaded runtime.
Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
## Credits
Thank you to [creepycode](https://github.com/ByteZ1337) and [carabistouille](https://github.com/carabistouflette) for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0384.html) for additional details.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
tokio1.54.0>=1.54.1<1.54.0Summary
On the multi-threaded runtime, there is a race condition between
Interval::poll_tickand the runtime's time driver.This affects
Intervalonly.SleepandTimeoutare not affected.Details
In Tokio v1.54.0, a race condition between
tokio::time::Interval::poll_tick(including.tick().await) and the runtime time driver can drop an internal timer entry without synchronizing with the driver thread that is firing it. This causes a data race and use-after-free on the timer's waker and task state in safe Rust, leading to assertion panics, task reference-count corruption, or heap memory corruption.This bug was introduced by https://github.com/tokio-rs/tokio/pull/8458, and it was fixed by https://github.com/tokio-rs/tokio/pull/8692.
Impact
This may lead to crashes and use-after-frees in applications using
Intervalon a multi-threaded runtime.Since this issue is known to lead to crashes in production systems, the v1.54.0 release of Tokio has been yanked.
Credits
Thank you to creepycode and carabistouille for reporting this privately using the procedure outlined in our security policy. They both reported the issue independently of each other.
See advisory page for additional details.