The Spectrum Dispatch News

technology

Researchers Identify Lifetime Soundness Flaw in Rust Borrow Checker

The flaw lets code assign a reference with a shorter lifetime to a field that requires a 'static lifetime, violating the borrow checker’s guarantees.

Researchers Identify Lifetime Soundness Flaw in Rust Borrow Checker

The issue #164250 on the rust-lang/rust GitHub repository describes a lifetime soundness bug in Rust’s borrow checker that has persisted for several years. According to the issue description, the problem occurs when a struct field is declared with a 'static + Send bound, yet the field can be assigned a reference that has a shorter lifetime through covariant field assignment. The issue provides a minimal example: a variable l of type String is stored in a field of type Option<&'static String> via the assignment q.0 = Some(&l);. After the assignment, the code extracts the field as a &'static String and uses it once l has gone out of scope. When run with AddressSanitizer, the program triggers a stack‑use‑after‑scope error, demonstrating that the borrow checker failed to enforce the required lifetime.

Researchers Identify Lifetime Soundness Flaw in Rust Borrow Checker

The issue notes that the problematic code compiles on the current nightly toolchain and on stable releases as far back as Rust 1.85.0. One commenter observes that the same pattern has been compiling since Rust 1.18.0, which was released in 2017, while another points out that the unsoundness dates back to at least Rust 1.4. The discussion includes several code variants that illustrate the flaw, including versions that spawn a thread to read the incorrectly assumed static reference after a short sleep, resulting in a segmentation fault or the printing of freed memory.

Community reactions show significant concern, with many users marking the issue as high priority (P‑high) and linking it to earlier reports such as #128225. The title of the issue was updated on October 13, 2026 to more precisely describe the problem: “struct’s lifetime requirements can be bypassed via covariant field assignment.” The issue remains open, with participants calling for a fix in the borrow checker’s handling of covariance for struct fields. The conversation emphasizes that the bug is not limited to a single pattern but stems from a broader misunderstanding of how lifetime bounds are checked during field assignment, suggesting that a more thorough analysis of covariance rules may be required to prevent similar unsoundness in the future.

Key facts

Sources

← All posts