---
id: RUSTSEC-2026-0284
title: >-
  Double free in `Map::into_iter` and an uninitialized `Arc` in
  `SharedIncin::clear`
summary: >-
  Double free in `Map::into_iter` and an uninitialized `Arc` in
  `SharedIncin::clear`
severity: none
vendor: lockfree
product: lockfree
ecosystem: rust
affected:
  - lockfree >= 0.0.0-0
published: '2026-08-26'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T10:00:03.017665783Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0284'
references:
  - url: 'https://crates.io/crates/lockfree'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0284.html'
  - url: 'https://gitlab.com/bzim/lockfree/-/issues/7'
tags:
  - osv
  - rust
ingestedAt: '2026-09-14T16:19:12.298Z'
---

## Overview

Two independent soundness problems, both reachable from safe Rust.

`Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by
hand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is
user code and may panic. If it does, `mem::forget(self)` is skipped and the
still-live `Map` unwinds, whose field drop glue destroys `builder` a second
time. An empty map is enough — no entries or concurrency required.

`SharedIncin::clear` writes `mem::uninitialized::<Arc<_>>()` into `self.inner`
before taking the real `Arc` out. `Arc` has a validity invariant, so this is
undefined behaviour at the point of creation, with no panic or concurrency
involved. Between that write and the repairing one, `self.inner` also holds
garbage while `self` is still droppable, so an unwind from `incin.clear()` or
`Arc::new` decrements a refcount through an uninitialized pointer. The
`make_shared_incin!` macro is instantiated five times, so this covers `queue`,
`stack`, `map`, `channel::spmc` and `channel::mpmc`.

## Impact

* CWE-415 (Double Free): the same allocation is freed twice.
* CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`.
* CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes.

## Fix

No fixed release is available. The crate has had no release since 2018-11-18 and
the maintainer has not responded to the report.

## Affected packages

- `lockfree >= 0.0.0-0`

## Remediation

Refer to the advisory for the patched release.