[renovate]

This PR contains the following updates:

Package	Type	Update	Change
mnl	dependencies	minor	0.2 → 0.3
tokio (source)	dev-dependencies	minor	1.48.0 → 1.51.6
tokio (source)	dependencies	minor	1.48.0 → 1.51.6

---

mnl has segmentation fault and invalid memory read in mnl::cb_run

GHSA-585q-cm62-757j / RUSTSEC-2025-0142

More information

Details

The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

Severity

• CVSS Score: 2.0 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

• https://github.com/mullvad/mnl-rs/issues/15
• https://github.com/mullvad/mnl-rs/pull/21
• https://github.com/mullvad/mnl-rs/commit/61929d11c13b6cc4f864840a586fd48c6fd20ad9
• https://github.com/mullvad/mnl-rs
• https://rustsec.org/advisories/RUSTSEC-2025-0142.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Segmentation fault and invalid memory read in mnl::cb_run

GHSA-585q-cm62-757j / RUSTSEC-2025-0142

More information

Details

The function mnl::cb_run is marked as safe but exhibits unsound behavior when processing malformed Netlink message buffers.

Passing a crafted byte slice to mnl::cb_run can trigger memory violations. The function does not sufficiently validate the input buffer structure before processing, leading to out-of-bounds reads.

This vulnerability allows an attacker to cause a Denial of Service (segmentation fault) or potentially read unmapped memory by providing a malformed Netlink message.

The underlying issue is a bug in libmnl where during validation nlh->nlmsg_len is cast to an int and becomes negative if nlmsg_len is greater than INT_MAX. This causes the validation to succeed even if the buffer is too small for the message. This has been fixed in libmnl but still affects version 1.0.5.

The issue in mnl was fixed in commit cd51bdc by checking the validity of netlink messages passed to mnl::cb_run.

Severity

Unknown

References

• https://crates.io/crates/mnl
• https://rustsec.org/advisories/RUSTSEC-2025-0142.html
• https://github.com/mullvad/mnl-rs/issues/15

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

AsyncFd::new and related constructors violate I/O safety

RUSTSEC-2026-0386

More information

Details

tokio::io::unix::AsyncFd provides safe constructors (new, with_interest, try_new, and try_with_interest) that accept any T: AsRawFd rather than requiring proof of ownership or validity of the file descriptor. Because RawFd implements AsRawFd, safe code can construct an AsyncFd from an arbitrary or closed file descriptor, or close/replace the underlying file descriptor while the AsyncFd is still alive.

This violates I/O safety in two ways:

1. AsyncFd<T> implements AsFd for all T: AsRawFd by calling BorrowedFd::borrow_raw(self.as_raw_fd()), allowing safe code to obtain an arbitrary BorrowedFd<'_> without owning the file descriptor.
2. Tokio's I/O driver stores a pointer to an internal allocation in the epoll/kqueue user data for registered file descriptors. If the underlying file descriptor is duplicated and then closed while an AsyncFd is alive, and the OS reuses that file descriptor number for a another IO resource on the same runtime, dropping the first AsyncFd deregisters the reused file descriptor number and frees the first while the original file description remains registered in epoll, leading to a use-after-free when a readiness event fires.

Starting in Tokio 1.51.6, 1.53.3, and 1.54.0, AsyncFd::new, AsyncFd::with_interest, AsyncFd::try_new, and AsyncFd::try_with_interest are deprecated in favor of the unsafe constructors AsyncFd::register and AsyncFd::register_with_interest. Callers must ensure that the file descriptor remains valid, open, and unchanged for the lifetime of the AsyncFd.

Severity

Unknown

References

• https://crates.io/crates/tokio
• https://rustsec.org/advisories/RUSTSEC-2026-0386.html
• https://github.com/tokio-rs/tokio/pull/8587
• https://github.com/tokio-rs/tokio/issues/8538
• https://github.com/tokio-rs/tokio/issues/8539

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

mullvad/mnl-rs (mnl)

v0.3.1

Compare Source

Fixed

• Fix unsoundness in cb_run and cb_run2 when called with malformed netlink messages.
  This fixes RUSTSEC-2025-0142.

v0.3.0

Compare Source

Changed

• Rename Socket::recv to Socket::recv_raw.
• Add new Socket::recv that returns an iterator of netlink messages (NlMessages).
• Update to Rust 2024 and bump MSRV to 1.85.

tokio-rs/tokio (tokio)

v1.51.6: Tokio v1.51.6

Compare Source

1.51.6 (October 13th, 2026)

Added

• io: add AsyncFd::register and AsyncFd::register_with_interest (#​8587)

Changed

• io: deprecate AsyncFd::{new, with_interest, try_new, try_with_interest} (#​8587)

Fixed

• io: wake and drop DuplexStream wakers outside the lock (#​8618)
• macros: avoid unreachable_code in join! and try_join! for Infallible (#​8518)
• runtime: fix paused time auto-advancing when I/O wakes a task on current_thread (#​8595)
• sync: wake waiters outside the lock when closing a semaphore (#​8529)
• test: fix several flaky tests (#​8196, #​8427, #​8609)

v1.51.5: Tokio v1.51.5

Compare Source

1.51.5 (October 3rd, 2026)

Fixed

• fs: handle integer overflow in buffered relative seek (#​8574)
• io: revert "always cleanup AsyncFd registration list on deregister" (#​8540)
• process: unregister Windows wait before closing child handle (#​8564)
• rt: drop blocking pool mutex before shutting down rejected task (#​8562)
• sync: fix mpsc index wraparound in block reclamation (#​8546)
• sync: forget mpsc Permit before sending value (#​8560)
• sync: validate MAX_PERMITS in Semaphore::acquire (#​8548)
• sync: wake broadcast Sender::closed outside mutex (#​8558)
• task: drop replaced waker outside lock in JoinSet (#​8554)
• time: drop timer lock before dropping waker in clear_entry (#​8552)
• time: expire timers directly on shutdown without rotating wheel (#​8570)

Fixed (unstable)

• rt: ignore current_thread task dumps from other runtimes (#​8544)
• rt: preserve io_uring context if a completion waker panics (#​8566)
• sync: fix semaphore use-after-free and permit leak on tracing panic (#​8542)
• time: drop stored waker when cancelling alt timer entry (#​8550)

v1.51.4: Tokio v1.51.4

Compare Source

1.51.4 (July 16th, 2026)

Fixed

• runtime: don't skip the driver when before_park schedules work (#​8222)

v1.51.3: Tokio v1.51.3

Compare Source

1.51.3 (May 8th, 2026)

Fixed

• sync: fix underflow in mpsc channel len() (#​8062)
• sync: notify receivers in mpsc OwnedPermit::release() method (#​8075)
• sync: require that an RwLock has max_readers != 0 (#​8076)
• sync: return Empty from try_recv() when mpsc is closed with outstanding permits (#​8074)

v1.51.2: Tokio v1.51.1

Compare Source

1.51.2 (May 4th, 2026)

This release reverts the LIFO slot stealing change introduced in 1.51.0 (#​7431), due to its performance impact. (#​8100)

v1.51.1: Tokio v1.51.1

Compare Source

1.51.1 (April 8th, 2026)

Fixed

• sync: fix semaphore reopens after forget (#​8021)
• net: surface errors from SO_ERROR on recv for UDP sockets on Linux (#​8001)

Fixed (unstable)

• metrics: fix worker_local_schedule_count test (#​8008)
• rt: do not leak fd when cancelling io_uring open operation (#​7983)

v1.51.0: Tokio v1.51.0

Compare Source

1.51.0 (April 3rd, 2026)

Added

• net: implement get_peer_cred on Hurd (#​7989)
• runtime: add tokio::runtime::worker_index() (#​7921)
• runtime: add runtime name (#​7924)
• runtime: stabilize LocalRuntime (#​7557)
• wasm: add wasm32-wasip2 networking support (#​7933)

Changed

• runtime: steal tasks from the LIFO slot (#​7431)

Fixed

• docs: do not show "Available on non-loom only." doc label (#​7977)
• macros: improve overall macro hygiene (#​7997)
• sync: fix notify_waiters priority in Notify (#​7996)
• sync: fix panic in Chan::recv_many when called with non-empty vector on closed channel (#​7991)

v1.50.0: Tokio v1.50.0

Compare Source

1.50.0 (Mar 3rd, 2026)

Added

• net: add TcpStream::set_zero_linger (#​7837)
• rt: add is_rt_shutdown_err (#​7771)

Changed

• io: add optimizer hint that memchr returns in-bounds pointer (#​7792)
• io: implement vectored writes for write_buf (#​7871)
• runtime: panic when event_interval is set to 0 (#​7838)
• runtime: shorten default thread name to fit in Linux limit (#​7880)
• signal: remember the result of SetConsoleCtrlHandler (#​7833)
• signal: specialize windows Registry (#​7885)

Fixed

• io: always cleanup AsyncFd registration list on deregister (#​7773)
• macros: remove (most) local use declarations in tokio::select! (#​7929)
• net: fix GET_BUF_SIZE constant for target_os = "android" (#​7889)
• runtime: avoid redundant unpark in current_thread scheduler (#​7834)
• runtime: don't park in current_thread if before_park defers waker (#​7835)
• io: fix write readiness on ESP32 on short writes (#​7872)
• runtime: wake deferred tasks before entering block_in_place (#​7879)
• sync: drop rx waker when oneshot receiver is dropped (#​7886)
• runtime: fix double increment of num_idle_threads on shutdown (#​7910, #​7918, #​7922)

Unstable

• fs: check for io-uring opcode support (#​7815)
• runtime: avoid lock acquisition after uring init (#​7850)

Documented

• docs: update outdated unstable features section (#​7839)
• io: clarify the behavior of AsyncWriteExt::shutdown() (#​7908)
• io: explain how to flush stdout/stderr (#​7904)
• io: fix incorrect and confusing AsyncWrite documentation (#​7875)
• rt: clarify the documentation of Runtime::spawn (#​7803)
• rt: fix missing quotation in docs (#​7925)
• runtime: correct the default thread name in docs (#​7896)
• runtime: fix event_interval doc (#​7932)
• sync: clarify RwLock fairness documentation (#​7919)
• sync: clarify that recv returns None once closed and no more messages (#​7920)
• task: clarify when to use spawn_blocking vs dedicated threads (#​7923)
• task: doc that task drops before JoinHandle completion (#​7825)
• signal: guarantee that listeners never return None (#​7869)
• task: fix task module feature flags in docs (#​7891)
• task: fix two typos (#​7913)
• task: improve the docs of Builder::spawn_local (#​7828)
• time: add docs about auto-advance and when to use sleep (#​7858)
• util: fix typo in docs (#​7926)

v1.49.0: Tokio v1.49.0

Compare Source

1.49.0 (January 3rd, 2026)

Added

• net: add support for TCLASS option on IPv6 (#​7781)
• runtime: stabilize runtime::id::Id (#​7125)
• task: implement Extend for JoinSet (#​7195)
• task: stabilize the LocalSet::id() (#​7776)

Changed

• net: deprecate {TcpStream,TcpSocket}::set_linger (#​7752)

Fixed

• macros: fix the hygiene issue of join! and try_join! (#​7766)
• runtime: revert "replace manual vtable definitions with Wake" (#​7699)
• sync: return TryRecvError::Disconnected from Receiver::try_recv after Receiver::close (#​7686)
• task: remove unnecessary trait bounds on the Debug implementation (#​7720)

Unstable

• fs: handle EINTR in fs::write for io-uring (#​7786)
• fs: support io-uring with tokio::fs::read (#​7696)
• runtime: disable io-uring on EPERM (#​7724)
• time: add alternative timer for better multicore scalability (#​7467)

Documented

• docs: fix a typos in bounded.rs and park.rs (#​7817)
• io: add SyncIoBridge cross-references to copy and copy_buf (#​7798)
• io: doc that AsyncWrite does not inherit from std::io::Write (#​7705)
• metrics: clarify that num_alive_tasks is not strongly consistent (#​7614)
• net: clarify the cancellation safety of the TcpStream::peek (#​7305)
• net: clarify the drop behavior of unix::OwnedWriteHalf (#​7742)
• net: clarify the platform-dependent backlog in TcpSocket docs (#​7738)
• runtime: mention LocalRuntime in new_current_thread docs (#​7820)
• sync: add missing period to mpsc::Sender::try_send docs (#​7721)
• sync: clarify the cancellation safety of oneshot::Receiver (#​7780)
• sync: improve the docs for the errors of mpsc (#​7722)
• task: add example for spawn_local usage on local runtime (#​7689)

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.