--- title: "Cloudflare's Rust panic and Linux's first Rust CVE: what memory safety did not prevent" summary: "Two projects' own accounts, November and December 2025: a Cloudflare outage that began with a Rust panic, and the first Linux kernel CVE in Rust code, inside an unsafe block." url: https://www.thetechbag.com/blog/what-memory-safety-did-not-prevent format: Note desk: "Cloud & DevOps" published: 2026-10-18 facts_checked: 2026-10-18 author: TechBag (The TechBag Journal) tags: ["Rust","memory safety","Cloudflare","outage","postmortem","Linux kernel","CVE-2025-68260","Android Binder","unsafe Rust"] cover: https://www.thetechbag.com/blog/covers/what-memory-safety-did-not-prevent.png --- # Cloudflare's Rust panic and Linux's first Rust CVE: what memory safety did not prevent *Two projects' own accounts, November and December 2025: a Cloudflare outage that began with a Rust panic, and the first Linux kernel CVE in Rust code, inside an unsafe block.* Note · Cloud & DevOps · By TechBag · Published 2026-10-18 · Facts checked 2026-10-18 · Canonical: https://www.thetechbag.com/blog/what-memory-safety-did-not-prevent On 18 November 2025, from 11:20 UTC, most of Cloudflare’s core traffic stopped flowing because its proxy, written in Rust, met a file larger than it allowed and stopped itself. Cloudflare called it its worst outage since 2019.[1] Four weeks later the Linux kernel published the first CVE for its Rust code: a bug that corrupted memory, inside a block the programmer had marked `unsafe`.[3][5] Rust is a memory-safe language. Both accounts, read in each project’s own words, show what that covers and what it does not. ## Cloudflare: a limit, a bad file and an unwrap At 11:05 Cloudflare changed database permissions. A query that builds the feature file for its Bot Management model began returning duplicate rows, and the file doubled in size. The proxy allows 200 features, against about 60 in use, and reserves memory for them in advance. The new FL2 proxy, in Rust, hit the limit and stopped with the message “called `Result::unwrap()` on an `Err` value”, serving errors to visitors. The older FL proxy, built on NGINX and Lua, read the same file without an error but gave every request a bot score of zero, so customers who block bots blocked real users. Core traffic was largely back by 14:30 and every system by 17:06.[1] `unwrap` means “this step worked; if it did not, stop”. The proxy never read or wrote memory it should not have. It stopped, as written, on an input nobody expected. Cloudflare’s fixes are about inputs and failure: treat its own configuration files as carefully as user input, add more global kill switches, and review how every proxy module fails.[1] Seventeen days later, on 5 December, about 28% of Cloudflare’s HTTP traffic failed for some 25 minutes on a Lua error in the old FL proxy. Cloudflare wrote that “this type of code error is prevented by languages with strong type systems” and that in FL2, in Rust, “the error did not occur”.[2] ## Linux: a race inside unsafe code Binder is how Android apps and services talk to each other; Linux 6.18, released on 30 November 2025, shipped a Rust version of its kernel driver.[7] CVE-2025-68260, published on 16 December, quotes the line at fault: an `unsafe` list removal whose comment assumed no other thread could touch the item. One could. Two threads changed the same pointers, which “leads to memory corruption” and crashes. Linux 6.18.1 fixed it on 12 December.[3][7] `unsafe` marks code the Rust compiler does not check, where the programmer vouches for memory instead. Greg Kroah-Hartman, who runs the kernel’s CVE process, wrote that day that Rust is not “a ‘silver bullet’” but “will cut out huge swatches of Linux kernel vulnerabilities”, that this bug “just causes a crash”, and that 159 other kernel CVEs issued the same day were for C code.[5] The record, as updated on 5 August 2026, scores it 7.8 (High) and describes a path from the corruption to a use-after-free and, potentially, to control of the kernel.[3] TechBag countHow many since We counted eight more kernel CVEs titled `rust_binder`, announced between 31 January and 25 July 2026, in the kernel’s announcement archive. A title does not say whether a bug touched memory.[6] ## One class of bug, not all bugs Memory safety means the compiler refuses code that reads or writes memory it should not: running past the end of a buffer, or using memory after it has been freed. It does not check whether an input fits a limit, what a program does when a step fails, or the promise a programmer makes inside `unsafe`. Cloudflare wrote this in September 2025, when it moved traffic to FL2: Rust “eliminates entire classes of bugs”, yet “it’s easy to write code in Rust, which causes memory corruption”, so it adds linting, coding standards and review.[4] **Figure: Within four weeks, Cloudflare's Rust proxy stopped on a bad file and kernel Rust code corrupted memory inside unsafe** *Events in each project's own record, September 2025 to August 2026* | Date | Event | Detail | | --- | --- | --- | | 26 Sept 2025 | Cloudflare: FL2 in Rust | “entire classes of bugs” removed; memory corruption still “easy to write” | | 18 Nov 2025 | Rust proxy panics | Oversized Bot Management file; 11:20 to 17:06 UTC; old proxy scored all traffic zero | | 30 Nov 2025 | Linux 6.18 | First release with the Rust Binder driver | | 5 Dec 2025 | Lua proxy fails | About 28% of HTTP traffic for 25 minutes; did not occur in the Rust FL2 | | 12 Dec 2025 | Linux 6.18.1 | Fixes the death_list race | | 16 Dec 2025 | CVE-2025-68260 | First kernel CVE for Rust code; memory corruption in an unsafe block | | 5 Aug 2026 | Record updated | CVSS 3.1 score 7.8, High | Source: Cloudflare blog; Linux kernel CVE record, announcement and git tags · as of 18 October 2026 · Cloudflare times are UTC; kernel dates are release or publication days Each record says what failed and what changed: at Cloudflare, how the proxy treats its own configuration and fails; in the kernel, the one line whose safety comment assumed too much. How we did this Figures as of 18 October 2026 Every account is the project’s own: Cloudflare’s postmortems and engineering write-up, the Linux kernel’s CVE record and announcement, its maintainer’s post and the kernel’s git tags. Times are UTC. The CVE record’s score was added after publication; we give the date of the update. Our count covers announcements whose title begins `rust_binder`, from the linux-cve-announce archive; other Rust components, and bugs whose titles do not name Rust, are not in it. The same archive lists 160 kernel CVEs on 16 December 2025, which matches Kroah-Hartman’s “159 other”. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Cloudflare (Matthew Prince), Cloudflare outage on November 18, 2025](https://blog.cloudflare.com/18-november-2025-outage/) — 18 November 2025 2. [Cloudflare (Dane Knecht), Cloudflare outage on December 5, 2025](https://blog.cloudflare.com/5-december-2025-outage/) — 5 December 2025 3. [Linux kernel CNA, CVE-2025-68260: rust_binder: fix race condition on death_list (CVE record)](https://cveawg.mitre.org/api/cve/CVE-2025-68260) — 16 December 2025; updated 5 August 2026 4. [Cloudflare, Cloudflare just got faster and more secure, powered by Rust](https://blog.cloudflare.com/20-percent-internet-upgrade/) — 26 September 2025 5. [Greg Kroah-Hartman, post on social.kernel.org](https://social.kernel.org/notice/B1JLrtkxEBazCPQHDM) — 16 December 2025 6. [linux-cve-announce archive, announcements titled rust_binder](https://lore.kernel.org/linux-cve-announce/?q=rust_binder) — 16 December 2025 to 25 July 2026 7. [Linux kernel git: v6.18 tag and the 6.18.1 stable fix](https://git.kernel.org/stable/c/3428831264096d32f830a7fcfc7885dd263e511a) — 30 November 2025 and 12 December 2025 Related on TechBag: the [Cloudflare hub](https://www.thetechbag.com/cloudflare) and the [observability guide](https://www.thetechbag.com/browse/devops/observability-apm). **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [The Cloudflare hub](https://www.thetechbag.com/cloudflare) — every Cloudflare product TechBag covers, with dated claims - [Cloudflare CDN & performance](https://www.thetechbag.com/cloudflare/cloudflare-cdn-performance) — the proxy layer the 18 November outage ran through - [Observability & APM guide](https://www.thetechbag.com/browse/devops/observability-apm) — how teams see a failure like this one as it starts