Cloudflare's Rust panic and Linux's first Rust CVE: what memory safety did not prevent

01Cloudflare: a limit, a bad file and an unwrap

At 11:05 Cloudflare changed database permissions. A query that builds the feature file for its Bot Management model began returning duplicate rows, and the file doubled in size. The proxy allows 200 features, against about 60 in use, and reserves memory for them in advance. The new FL2 proxy, in Rust, hit the limit and stopped with the message “called Result::unwrap() on an Err value”, serving errors to visitors. The older FL proxy, built on NGINX and Lua, read the same file without an error but gave every request a bot score of zero, so customers who block bots blocked real users. Core traffic was largely back by 14:30 and every system by 17:06.¹

unwrap means “this step worked; if it did not, stop”. The proxy never read or wrote memory it should not have. It stopped, as written, on an input nobody expected. Cloudflare’s fixes are about inputs and failure: treat its own configuration files as carefully as user input, add more global kill switches, and review how every proxy module fails.¹

Seventeen days later, on 5 December, about 28% of Cloudflare’s HTTP traffic failed for some 25 minutes on a Lua error in the old FL proxy. Cloudflare wrote that “this type of code error is prevented by languages with strong type systems” and that in FL2, in Rust, “the error did not occur”.²

02Linux: a race inside unsafe code

Binder is how Android apps and services talk to each other; Linux 6.18, released on 30 November 2025, shipped a Rust version of its kernel driver.⁷ CVE-2025-68260, published on 16 December, quotes the line at fault: an unsafe list removal whose comment assumed no other thread could touch the item. One could. Two threads changed the same pointers, which “leads to memory corruption” and crashes. Linux 6.18.1 fixed it on 12 December.³⁷

unsafe marks code the Rust compiler does not check, where the programmer vouches for memory instead. Greg Kroah-Hartman, who runs the kernel’s CVE process, wrote that day that Rust is not “a ‘silver bullet’” but “will cut out huge swatches of Linux kernel vulnerabilities”, that this bug “just causes a crash”, and that 159 other kernel CVEs issued the same day were for C code.⁵ The record, as updated on 5 August 2026, scores it 7.8 (High) and describes a path from the corruption to a use-after-free and, potentially, to control of the kernel.³

03One class of bug, not all bugs

Memory safety means the compiler refuses code that reads or writes memory it should not: running past the end of a buffer, or using memory after it has been freed. It does not check whether an input fits a limit, what a program does when a step fails, or the promise a programmer makes inside unsafe. Cloudflare wrote this in September 2025, when it moved traffic to FL2: Rust “eliminates entire classes of bugs”, yet “it’s easy to write code in Rust, which causes memory corruption”, so it adds linting, coding standards and review.⁴

Each record says what failed and what changed: at Cloudflare, how the proxy treats its own configuration and fails; in the kernel, the one line whose safety comment assumed too much.