A race condition between tokio::time::Interval::poll_tick and the multi-threaded runtime’s time driver can drop an internal timer entry without proper synchronization. This use‑after‑free in safe Rust may trigger assertion panics, corrupt a task’s reference count, or corrupt heap memory. The impact includes possible application crashes, denial of service, and if the heap corruption is exploitable, potential arbitrary code execution.

The Tokio runtime (tokio-rs:tokio) is affected. The vulnerability exists in version 1.54.0 and is fixed in 1.54.1. Users running applications that depend on the 1.54.0 release should be aware that any use of Interval::tick() or poll_tick() may be vulnerable.

The CVSS score of 5.8 indicates a moderate severity assessment. EPSS data is not available, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to launch an application or control code that uses the vulnerable tokio timer logic in a multi-threaded context. While a panic or crash is directly observable, memory corruption could enable further attacks if the attacker can influence the corrupted data. The recommended remediation is to update to a patched version.