AIKIDO-2026-671914

TL;DR

The pop method on LruCache frees a cache node's heap allocation and runs the stored key's destructor before detaching the node from the internal doubly linked list. When a key type has a Drop implementation that panics, unwinding skips the detach step, so the neighboring list nodes keep raw pointers into the freed allocation. Later cache operations then dereference those dangling pointers, producing a use-after-free that is reachable from safe Rust. The fix detaches the node from the list before dropping the key so the list stays consistent even if the destructor panics.