RUSTSEC-2026-0453

Dashboard / Vulnerabilities / RUSTSEC-2026-0453

RUSTSEC-2026-0453

Summary: Use-after-free in KV backends via leaked `affinitypool::spawn_local` future

Details: The `kv-mem`, `kv-surrealkv` and `kv-rocksdb` backends move non-`'static` borrowed state into affinity-pool closures through `affinitypool::spawn_local`: a `tokio::sync::MutexGuard<Option<TransactionInner>>`, `&Transaction`, `&mut ScanStateKeys/Vals`, `&mut dyn KeyVisitor/ValVisitor`, `RwLockReadGuard`, and a `ReadOptions` holding a raw `rocksdb_snapshot_t*`. In `affinitypool 0.7.0` `spawn_local` is safe and erases the `'pool` lifetime via `async_task::Builder::spawn_unchecked`; the only thing keeping it sound is the `Drop` implementation of the returned future, which blocks until the worker stops using the borrows. Safe code can leak that future (`mem::forget`, `Box::leak`, `ManuallyDrop`, a reference cycle, or a leaked enclosing future). The borrows then end while the pool worker still uses them, producing a use-after-free on the transaction allocation; AddressSanitizer reports a read of freed mutex data and a write when the worker unlocks the freed `tokio::sync::Mutex` on the pool thread. No `unsafe` is required at the call site, and the affected methods include `count`, `keys`/`keysr`, `scan`/`scanr`, `compact`, shutdown, point reads and writes, and cursor iteration. 3.3.0 upgrades to `affinitypool 0.8.0`, where `spawn_local` is an `unsafe` function and the caller must uphold the leak-freedom invariant (commit `8156ff69`).

References: https://crates.io/crates/surrealdb, https://rustsec.org/advisories/RUSTSEC-2026-0453.html, https://github.com/surrealdb/surrealdb/commit/8156ff691b1861814199e5e3372c81609b68db7f