CVE-2022-36086 — linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

2026-10-08T16:25:20.459175+00:00

Affected: rust-osdev linked-list-allocator

linked_list_allocator is an allocator usable for no_std systems. Prior to version 0.10.2, the heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to out-of-bound writes when a heap was initialized with a size smaller than `3 * size_of::` because of metadata write operations. This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method. Version 0.10.2 contains a patch for the issue. As a workaround, ensure that the heap is only initialized with a size larger than `3 * size_of::` and that the `Heap::extend` method is only called with sizes larger than `2 * size_of::()`. Also, ensure that the total heap size is (and stays) a multiple of `2 * size_of::()`.

GHSA-xg8p-34w2-j49j — linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

2026-10-08T16:25:20.459263+00:00

Affected: crates.io: linked_list_allocator

## Impact _What kind of vulnerability is it? Who is impacted?_

This vulnerability impacts all the initialization functions on the `Heap` and `LockedHeap` types, including `Heap::new`, `Heap::init`, `Heap::init_from_slice`, and `LockedHeap::new`. It also affects multiple uses of the `Heap::extend` method.

### Initialization Functions

The heap initialization methods were missing a minimum size check for the given heap size argument. This could lead to **_out-of-bound writes_** when a heap was initialized with a size smaller than `3 * size_of::` because of metadata write operations.

### `Heap::extend`

This vulnerability impacts three specific uses of the `Heap::extend` method:

- When calling `Heap::extend` with a size smaller than two `usize`s (e.g., 16 on `x86_64`), the size was erroneously rounded up to the minimum size, which could result in an **_out-of-bounds write_**. - Calling `Heap::extend` on an empty heap tried to construct a heap starting at address 0, which is also an **_out-of-bounds write_**. - One specific way to trigger this accidentally is to call `Heap::new` (or a similar constructor) with a heap size that is smaller than two `usize`s. This was treated as an empty heap as well. - Calling `Heap::extend` on a heap whose size is not a multiple of the size of two `usize`s resulted in _unaligned writes_. It also left the heap in an unexpected state, which might lead to subsequent issues. We did not find a way to exploit this undefined behavior yet (a…

Most recent entries from all

CVE-2022-36086 — linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`

GHSA-xg8p-34w2-j49j — linked_list_allocator vulnerable to out-of-bound writes on `Heap` initialization and `Heap::extend`