Skip to content

22 free-threading race conditions #149816

Open
#150247
Open
22 free-threading race conditions#149816
#150247
Labels
interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-bugAn unexpected behavior, bug, or error

Description

@lunixbochs
lunixbochs
opened on May 14, 2026

Bug report

Changes

2026-05-13: Filed issue.
2026-06-08: Added new findings (16) and (86).

Bug description

I found 22 free-threading race conditions during a partial Xint Code scan of cpython. These only apply to the free-threaded build, and were all found and tested on commit 0534774 built with ./configure --disable-gil --enable-asan on an M3 Mac.

I'm attaching a zip file with detailed writeups of each, as well as reproduction cases for 15 of the 22 issues. I don't have scripts reproducing the findings numbered 21, 36, 82, 94, 106, 115, or 124. Race conditions can be difficult to trigger, and even the scripts I provided are trying to win tight races and may not always work.

I know this is a lot. @colesbury suggested I create a combined issue to make the triage discussion easier.

Let me know if you have any questions or concerns. The issues were found and written up by an automated system, but I have put additional work into the validation and reporting. I do want to be respectful of everyone's time while helping to make Python better.

Writeups

2026-05-13: Initial writeups and test scripts: cpython-ft.zip
2026-06-08: New writeups and test scripts for (16) and (86): cpython-ft-2026-06-08.zip

Many of the scripts are expected to crash, however some of them only produce exceptions or corrupted output. You should be able to run any of the scripts with PYTHON_GIL=1 set in your environment if you want to see a baseline without the race condition.

Finding List

  • (16) Cross-interpreter syslog race
  • (17) Unlocked __init__ races with PRNG state access in Modules/_randommodule.c
  • (21) Racy EVP_MD cache overwrite leaks references in Modules/_hashopenssl.c
  • (36) Borrowed type lookup races to use-after-free in Objects/typeobject.c
  • (49) SNI callback callable race use-after-free in Modules/_ssl.c
  • (61) Racy weakref head load before incref in Objects/typeobject.c
  • (62) Concurrent kwargs growth causes heap overwrite in Objects/call.c
  • (69) Unsynchronized extra pointer dereference in len in Modules/_elementtree.c
  • (82) Non-atomic list slot memmove in shared list delete in Objects/listobject.c
  • (84) Iterator path bypasses buffered object lock in Modules/_io/bufferedio.c
  • (86) Cross-interpreter XID registry race
  • (87) Unsynchronized Element.text borrowed-pointer race in Modules/_elementtree.c
  • (89) Unsynchronized dict iteration causes borrowed-ref UAF in Modules/_pickle.c
  • (91) Racy list item borrow causes UAF in Modules/_pickle.c
  • (94) Async-exception setter races thread-state free in Python/pystate.c
  • (96) Racy GC callback list iteration in Python/gc_free_threading.c
  • (106) Immediate decref races lock-free reader in Modules/_ctypes/_ctypes.c
  • (108) Borrowed dict used after lock release in Objects/dictobject.c
  • (115) Split clear frees keys without QSBR in Objects/dictobject.c
  • (124) Stale keys race in attribute hint fastpath in Python/bytecodes.c
  • (125 wontfix) Struct reinit races with pack/unpack in Modules/_struct.c
  • (128) Borrowed list item raced before incref in Objects/bytesobject.c
  • (129) Reentrant __index__ causes released-buffer dereference in Objects/memoryobject.c
  • (132) Non-atomic exports race in memoryview.hex in Objects/memoryobject.c

CPython versions tested on:

3.14

Operating systems tested on:

macOS

Linked PRs

Activity

  1. sobolevn
    added a commit that references this issue on May 16, 2026

    [3.15] gh-149816: Fix a race condition in `_PyBytes_FromList` with fr…

    ec3aa6a

  2. Abhi210 commented on May 16, 2026

    @Abhi210
    Abhi210
    on May 16, 2026
    Contributor

    Working on (62) Concurrent kwargs growth causes heap overwrite in Objects/call.c

  3. YvesDup commented on May 18, 2026

    @YvesDup
    YvesDup
    on May 18, 2026
    Contributor

    Working on (62) Concurrent kwargs growth causes heap overwrite in Objects/call.c

    @Abhi210, do you have a suggestion? I’m working on this too, and I suggest two options. Can I go further?

  4. sobolevn
    added a commit that references this issue on May 18, 2026

    gh-149816: Fix a RC in `_random.Random.__init__` method (#149824)

    14af19e
  5. kumaraditya303
    added a commit that references this issue on May 18, 2026

    gh-149816: fix `dict.clear()` race on split-table dict with non-embed…

    1692854
  6. sobolevn
    added 2 commits that reference this issue on May 18, 2026

    [3.15] gh-149816: Fix a RC in `_random.Random.__init__` method (GH-14…

    01b07df

    [3.14] gh-149816: Fix a RC in `_random.Random.__init__` method (GH-14…

    21a7236
  7. kumaraditya303
    added a commit that references this issue on May 18, 2026

    gh-149816: fix thread safety of deletion of list slice (#149936)

    00ea776

  8. kiri11 commented on May 18, 2026

    @kiri11
    kiri11
    on May 18, 2026
    Contributor

    @picnixz I will have a look at all issues related to SSL and crypto myself in 10 days unless someone beats me to it.

    I am taking a look at those today, starting with (49) SNI callback callable race use-after-free in Modules/_ssl.c.
    Will need help with reviewing.

  9. scopreon commented on May 18, 2026

    @scopreon
    scopreon
    on May 18, 2026
    Contributor

    Hi! I'm looking into (89) Unsynchronized dict iteration causes borrowed-ref UAF in Modules/_pickle.c

  10. dzaramelcone commented on May 18, 2026

    @dzaramelcone
    dzaramelcone
    on May 18, 2026
    Contributor

    I'm taking a look at 96!

  11. alexkats
    added a commit that references this issue on May 18, 2026

    pythongh-149816: Fix UAF in Modules/_pickle.c

    6f86dcf
  12. scopreon
    added 2 commits that reference this issue on May 18, 2026

    pythongh-149816: Fix race condition in pickle's batch_dict_exact_impl…

    b161772

    pythongh-149816: Improve locking granularity in pickle's batch_dict_e…

    45d736f
  13. dzaramelcone
    added 2 commits that reference this issue on May 18, 2026

    pythongh-149816: python#96 Fix race condition in with free threading

    6d8a147

    pythongh-149816: python#96 Fix race condition in `invoke_gc_callback`…

    fa7e93a
  14. alexkats
    added 5 commits that reference this issue on May 18, 2026

    pythongh-149816: Fix UAF in Modules/_pickle.c

    b3fbc16

    pythongh-149816: Check for changed list size in Modules/_pickle.c

    a3af3f3

    pythongh-149816: Check for changed list size in Modules/_pickle.c

    f137ba9

    pythongh-149816: Fix UAF in Modules/_pickle.c

    2dd1fc1

    pythongh-149816: Check for changed list size in Modules/_pickle.c

    ba6cf2d
  15. dzaramelcone
    added 2 commits that reference this issue on May 19, 2026

    Merge branch 'main' into pythongh-149816-96

    1bd05ca

    Merge branch 'main' into pythongh-149816-96

    76681e8
  16. alexkats
    added 2 commits that reference this issue on May 19, 2026

    pythongh-149816: Fix UAF in Modules/_pickle.c

    6e4987c

    pythongh-149816: Check for changed list size in Modules/_pickle.c

    d1e3981
  17. kumaraditya303
    added 2 commits that reference this issue on May 19, 2026

    [3.15] gh-149816: fix thread safety of deletion of list slice (GH-149936

    0b92f01

    [3.15] gh-149816: fix `dict.clear()` race on split-table dict with no…

    d36e080
  18. dzaramelcone
    added a commit that references this issue on May 19, 2026

    Merge branch 'main' into pythongh-149816-96

    ec90630
  19. encukou
    added 3 commits that reference this issue on May 19, 2026

    gh-149816: Fix SNI callback callable race (GH-150018)

    8b31d08

    [3.14] gh-149816: Fix SNI callback callable race (GH-150018) (GH-150100)

    2744371

    gh-149816: Fix UAF in Modules/_pickle.c (GH-150024)

    d095ceb

  20. Abhi210 commented on May 20, 2026

    @Abhi210
    Abhi210
    on May 20, 2026
    Contributor

    Working on (62) Concurrent kwargs growth causes heap overwrite in Objects/call.c

    @Abhi210, do you have a suggestion? I’m working on this too, and I suggest two options. Can I go further?

    Yes sure! I will look at another issue then. I will take a look at 61 then

  21. sobolevn
    added a commit that references this issue on May 21, 2026

    [3.14] gh-149816: Fix a race condition in `_PyBytes_FromList` with fr…

    1d4f9ab
  22. colesbury
    added 2 commits that reference this issue on May 21, 2026

    pythongh-150191: Reduce concurrency in test_sni_callback_race

    211477c

    pythongh-150191: Avoid data race in test_sni_callback_race

    5ec6b3d
  23. Abhi210
    added 2 commits that reference this issue on May 22, 2026

    Merge branch 'main' into pythongh-149816-61

    90be5b9

    pythongh-149816: Fix race in subtype_getweakref in free-threading build

    8c09bcf
  24. kumaraditya303
    added 3 commits that reference this issue on May 23, 2026

    gh-149816: add missing critical section on self in buffered_iternext (#…

    e8545ed

    [3.15] gh-149816: add missing critical section on self in buffered_it…

    ca59d75

    [3.14] gh-149816: add missing critical section on self in buffered_it…

    2d94a6e

  25. Abhi210 commented on May 26, 2026

    @Abhi210
    Abhi210
    on May 26, 2026
    Contributor

    I will look at another issue too: (124) Stale keys race in attribute hint fastpath in Python/bytecodes.c.

  26. dzaramelcone
    added 2 commits that reference this issue on May 29, 2026

    pythongh-149816: python#96 Fix race condition in `invoke_gc_callback`…

    2306df8

    Merge branch 'main' into pythongh-149816-96

    5c71bc1

  27. LindaSummer commented on Jun 5, 2026

    @LindaSummer
    LindaSummer
    on Jun 5, 2026
    Contributor

    Hi Team,
    I'm trying to investigate the case (108) Borrowed dict used after lock release in Objects/dictobject.c and will update once I
    have any new findings.

  28. lunixbochs commented on Jun 8, 2026

    @lunixbochs
    lunixbochs
    on Jun 8, 2026
    ContributorAuthor

    I added two cross-interpreter free-threading races to the list (16) and (86), and attached another zip to the issue description with their writeups and reproduction scripts:

    • (16) Cross-interpreter syslog race: syslog.syslog() borrows a global without a cross-interpreter lock.
    • (86) Cross-interpreter XID registry race: the local XID registry relies on GIL acquisition for thread safety, which doesn't work in free-threaded builds.
  29. serhiy-storchaka
    added a commit that references this issue on Jun 8, 2026

    [3.15] gh-149816: Fix SNI callback callable race (GH-150018) (GH-150099)

    9997975

  30. IvyXu420 commented on Jun 10, 2026

    @IvyXu420
    IvyXu420
    on Jun 10, 2026
    Contributor

    #149918 fixes (69) Unsynchronized extra pointer dereference in len in Modules/_elementtree.c. Would any core dev like to review it? Thanks in advance!

  31. Abhi210 commented on Jun 25, 2026

    @Abhi210
    Abhi210
    on Jun 25, 2026
    Contributor

    @lunixbochs I am unable to reproduce the issue (124) Stale keys race in attribute hint fastpath in Python/bytecodes.c. Do you have a specific reproduction script or build configuration (ASAN flags, usleep placement, specific interleaving) that reliably surfaces #124 as a sanitizer report or assertion failure? Or is the intent that the issue is demonstrated purely through code-path analysis rather than a live crash/sanitizer report?

  32. Abhi210
    added a commit that references this issue on Jun 29, 2026

    pythongh-149816: Fix race in subtype_getweakref in free-threading build

    7caab50
  33. picnixz
    added 2 commits that reference this issue on Jul 4, 2026

    pythongh-149816: fix a race when fetching OpenSSL digests

    5e4cdc8

    pythongh-149816: fix a race when fetching OpenSSL digests

    f58811f
  34. dzaramelcone
    added 3 commits that reference this issue on Jul 11, 2026

    Merge branch 'main' into pythongh-149816-96

    a33bd91

    pythongh-149816: Avoid allocating callback info for empty list

    062d75a

    Merge branch 'main' into pythongh-149816-96

    f67ea2b
  35. Abhi210
    added a commit that references this issue on Jul 12, 2026

    pythongh-149816: Fix race in subtype_getweakref in free-threading build

    836ac21
  36. kumaraditya303
    added a commit that references this issue on Jul 15, 2026

    [3.15] gh-149816: Fix UAF in Modules/_pickle.c (GH-150024) (#153718)

    1268235
  37. nascheme
    added a commit that references this issue on Jul 17, 2026

    [3.14] gh-149816: Fix UAF in Modules/_pickle.c (GH-150024) (GH-153719)

    7ed9b91
  38. encukou
    added 2 commits that reference this issue on Aug 19, 2026

    Merge branch 'main' into pythongh-149816-96

    73d0954

    gh-149816: #96 Fix a race condition in invoke_gc_callback with free t…

    91d71dd
  39. encukou
    added a commit that references this issue on Oct 12, 2026

    [3.15] gh-149816: #96 Fix a race condition in invoke_gc_callback with…

    e96bd13
  40. nascheme
    closed this as completedin #150247on Oct 12, 2026
  41. nascheme
    added a commit that references this issue on Oct 12, 2026

    gh-149816: Fix race in subtype_getweakref in free-threading build (gh…

    f674db1

  42. lunixbochs commented on Oct 12, 2026

    @lunixbochs
    lunixbochs
    on Oct 12, 2026 · Hidden as resolved
    Author
  43. picnixz
    reopened this on Oct 12, 2026

  44. picnixz commented on Oct 12, 2026

    @picnixz
    picnixz
    on Oct 12, 2026 · Hidden as resolved
  45. nascheme
    added 2 commits that reference this issue on Oct 13, 2026

    [3.14] gh-149816: Fix race in subtype_getweakref in free-threading bu…

    2e332b2

    [3.15] gh-149816: Fix race in subtype_getweakref in free-threading bu…

    82bef22
  46. kevinprimeraquecreo-stack
    added this to Project_VKon Oct 18, 2026
  47. github-project-automation
    moved this to Todo in Project_VKon Oct 18, 2026
  48. github-project-automation
    moved this from Todo to In progress in Project_VKon Oct 18, 2026
  49. kevinprimeraquecreo-stack
    added this to Project_VKon Oct 18, 2026
  50. picnixz
    added a commit that references this issue on Oct 20, 2026

    gh-149816: fix a race when fetching OpenSSL digests (#153019)

    2346981
  51. ambv
    added a commit that references this issue on Oct 21, 2026

    [3.14] gh-149816: #96 Fix a race condition in invoke_gc_callback with…

    d8d3df5
  52. picnixz
    added 2 commits that reference this issue on Oct 21, 2026

    [3.15] gh-149816: fix a race when fetching OpenSSL digests (GH-153019) (

    605d16a

    [3.14] gh-149816: fix a race when fetching OpenSSL digests (GH-153019) (

    3d2f1b2
  53. DinoV
    added 4 commits that reference this issue on Oct 22, 2026

    gh-149816: Fix race between `setattr` and `object.__dict__` update (#…

    60e956e

    pythongh-149816: Fix another variant of race on setattr/managed dict …

    2f8aa46

    pythongh-149816: Fix another variant of race on setattr/managed dict …

    72a0e10

    pythongh-149816: Fix another variant of race on setattr/managed dict …

    e1162cd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions