PT-2026-76532

LruCache::pop in lru was not panic-safe. If the Drop implementation of a stored key panics during pop, self.detach is never called, leaving dangling pointers in the internal doubly-linked list. A subsequent cache operation that triggers eviction can then dereference these dangling pointers: - The...