--- title: An 11-year-old borrow checker hole surfaces, Head Start... description: The biggest news this week is a soundness bug in Rust's borrow checker that's been compiling clean since 2017 (and possibly 2015), letting safe code trigger... canonical: https://daily.dev/posts/an-11-year-old-borrow-checker-hole-surfaces-head-start-speeds-up-compilation-if9dkuwo7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: An 11-year-old borrow checker hole surfaces, Head Start speeds up compilation | daily.dev og:description: The biggest news this week is a soundness bug in Rust's borrow checker that's been compiling clean since 2017 (and possibly 2015), letting safe code trigger... og:url: https://daily.dev/posts/an-11-year-old-borrow-checker-hole-surfaces-head-start-speeds-up-compilation-if9dkuwo7 og:image: https://api.daily.dev/og/posts/if9DKuwo7.png og:image:alt: An 11-year-old borrow checker hole surfaces, Head Start speeds up compilation og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # An 11-year-old borrow checker hole surfaces, Head Start speeds up compilation **[Rust Digest](https://daily.dev/sources/rust_digest)** · 5 min read · 21 upvotes · 0 comments ## Summary The biggest news this week is a soundness bug in Rust's borrow checker that's been compiling clean since 2017 (and possibly 2015), letting safe code trigger use-after-free via a malicious Drop impl. Separately, two independent write-ups on the same Head Start compiler patch show up to 54% faster cargo check on real projects by overlapping compilation across dependency chains. Rustls shipped four security fixes including an uncapped memory allocation bug, and Rust 1.99.1 landed to fix three regressions including an FFI miscompilation on x86_64. Oxide also detailed Voxel, a full virtual rack emulator built on illumos and Rust that spins up in about 10 minutes. ## Content **TLDR:** The biggest news this week is a soundness bug in Rust's borrow checker that's been compiling clean since 2017 (and possibly 2015), letting safe code trigger use-after-free via a malicious Drop impl. Separately, two independent write-ups on the same Head Start compiler patch show up to 54% faster cargo check on real projects by overlapping compilation across dependency chains. Rustls shipped four security fixes including an uncapped memory allocation bug, and Rust 1.99.1 landed to fix three regressions including an FFI miscompilation on x86_64. Oxide also detailed Voxel, a full virtual rack emulator built on illumos and Rust that spins up in about 10 minutes. --- ## A borrow checker unsoundness bug traces back 11 years, no unsafe required Issue #164250 shows a stack reference can escape a 'static bound through field assignment combined with a custom Drop implementation, letting safe code read freed stack memory. The minimal repro uses a static Mutex holding a Box and a struct with a 'static + Send bound; a short-lived reference gets smuggled out when Drop captures it, confirmed by AddressSanitizer. It compiles on stable back to 1.18.0 (2017), with one trace reaching 1.4 (2015). The team classified it P-high rather than P-critical because it requires an intentionally malicious Drop impl, but the real story is that the compiler never actually checked whether Drop implementations honor inherited bounds. A fix is in progress via PR #164277. [Read more](https://daily.dev/feed-by-ids?id=QDLjjmPYk&id=lhmasseTq) ## Head Start lets dependent crates compile before dependencies finish type-checking Two separate write-ups this week covered the same project: an experimental patch set for rustc and cargo that starts compiling downstream crates against a dependency's interface metadata before its function bodies finish type-checking. Across 13 real projects including rust-analyzer, Zed, Bevy, and Polars on a 16-core machine, cargo check got up to 54% faster and cargo build up to 42% faster, with smaller gains on machines with fewer cores (one tester saw 24% on an M4 MacBook Air). The tradeoff is wasted downstream work when a dependency has a body-level error, plus higher peak memory and slightly delayed error reporting. It's not merged, but the team plans to upstream it and the error diagnostics and exit codes are already identical to normal builds. [Read more](https://daily.dev/feed-by-ids?id=D3jkocTjl&id=mdByGCOA0) ## Rustls 0.23.46 patches four security holes, including one that leaked TLS secrets into logs Thirteen bugs got fixed in this release, four of them security issues: an uncapped memory allocation in Brotli certificate decompression that could eat up to 1GB before authentication even completes, debug formatting that leaked TLS master secrets and resumption PSKs into logs, an unauthenticated ServerHello that could force a downgrade to classic X25519 key exchange, and client application data that could leak to a server even after it rejected Encrypted Client Hello. OpenAI gets a credit line here, having reported thirteen of the bugs including two of the security fixes, which says something about how fuzzing-at-scale is paying off for critical infrastructure crates. [Read more](https://daily.dev/posts/gT4KYLG3P) ## Rust 1.99.1 fixes an FFI miscompilation that left garbage bits in bool values The point release patches three regressions: a missing wcslen symbol breaking links on targets like UEFI, a macOS issue where rust-lld failed to load libLLVM without the rustup proxy, and the more serious one, a miscompilation where bool return values crossing FFI boundaries on x86_64 could leave unspecified bits instead of being properly zero-extended. That last bug is the kind that can silently corrupt logic in any Rust library exposing a C ABI, so if you're shipping FFI-facing bools, this is worth the update via rustup update stable. [Read more](https://daily.dev/feed-by-ids?id=bquNvdCkU&id=GD2CVlwGt) --- ## Also notable - **Oxide's Voxel emulates a full 6-sled rack in 10 minutes:** Built on illumos and Rust with Propolis, FRR, and a custom sp-emu tool that models real Cortex-M7/M33 microcontrollers, Voxel runs unmodified Hubris firmware and Omicron on a mini-PC with 32 threads and 96GB RAM, and sp-emu is now open source under MPL 2.0. [Read more](https://daily.dev/posts/wluNCqpJS) - **Asterinas 0.19.0 gets an X.Org server and AArch64 support:** The Rust kernel now runs X.Org on a new DRM subsystem with Mesa's LLVMpipe software renderer (no GPU acceleration yet), adds minimal AArch64 support alongside x86_64/RISC-V/LoongArch64, and can now build itself. [Read more](https://daily.dev/posts/RPiMWIyoS) - **Creusot 0.14.0 adds partial-order support for PartialOrd verification:** The formal verification tool replaces its Ordering-based total-order comparison with a boolean lt_log function and separate totality laws, plus rust-analyzer go-to-definition support inside Pearlite specifications. [Read more](https://daily.dev/posts/Hpnnq0zbW) - **Cloud Hypervisor 54 guarantees live migration across two prior major releases:** The release also adds VFIO device live migration for devices like ConnectX VFs, migration cancellation support, and experimental ARM SMMUv3 emulation. [Read more](https://daily.dev/posts/cj0iY1Aw3) - **Cloudflare's Logpush Transformers run on Apache DataFusion, processing 1.6M rows/sec:** A single prepared Transformer handles a 5,000-row batch in about 3ms by embedding the Rust-based DataFusion engine directly in Cloudflare's Go delivery service, crossing the Go/Rust boundary via Arrow IPC over cgo to avoid adding network calls to the export hot path. [Read more](https://daily.dev/posts/Q1TADNPPC) ## Similar posts on daily.dev - [Rustls 0.23.46 Released With Four Security Fixes](https://daily.dev/posts/rustls-0-23-46-released-with-four-security-fixes-gt4kylg3p) · Phoronix · 0 upvotes · 0 comments --- Tags: [#rust](https://daily.dev/tags/rust) [View this post on daily.dev](https://daily.dev/posts/an-11-year-old-borrow-checker-hole-surfaces-head-start-speeds-up-compilation-if9dkuwo7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/an-11-year-old-borrow-checker-hole-surfaces-head-start-speeds-up-compilation-if9dkuwo7","headline":"An 11-year-old borrow checker hole surfaces, Head Start speeds up compilation","text":"The biggest news this week is a soundness bug in Rust's borrow checker that's been compiling clean since 2017 (and possibly 2015), letting safe code trigger use-after-free via a malicious Drop impl. Separately, two independent write-ups on the same Head Start compiler patch show up to 54% faster cargo check on real projects by overlapping compilation across dependency chains. Rustls shipped four security fixes including an uncapped memory allocation bug, and Rust 1.99.1 landed to fix three regressions including an FFI miscompilation on x86_64. Oxide also detailed Voxel, a full virtual rack emulator built on illumos and Rust that spins up in about 10 minutes.","url":"https://daily.dev/posts/an-11-year-old-borrow-checker-hole-surfaces-head-start-speeds-up-compilation-if9dkuwo7","datePublished":"2026-10-19T04:17:51.333Z","dateModified":"2026-10-19T04:18:12.506Z","author":{"@type":"Organization","name":"Rust Digest","logo":"https://media.daily.dev/image/upload/s--YNSg30Q0--/f_auto,q_auto/v1773839405/logos/rust_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/rust_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":18},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/rust_digest","name":"Rust Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rust Digest","item":"https://daily.dev/sources/rust_digest"},{"@type":"ListItem","position":3,"name":"An 11-year-old borrow checker hole surfaces, Head Start speeds up compilation"}]} ```