diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-25-16-45-31.gh-issue-146427.sbxyZO.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-25-16-45-31.gh-issue-146427.sbxyZO.rst new file mode 100644 index 00000000000000..c1b1e0220be3eb --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-25-16-45-31.gh-issue-146427.sbxyZO.rst @@ -0,0 +1 @@ +Fix a use-after-free in :mod:`!_interpqueues` when clearing items from a destroyed interpreter. diff --git a/Modules/_interpqueuesmodule.c b/Modules/_interpqueuesmodule.c index 777b6854749884..c5591f3f35b531 100644 --- a/Modules/_interpqueuesmodule.c +++ b/Modules/_interpqueuesmodule.c @@ -763,6 +763,9 @@ _queue_clear_interpreter(_queue *queue, int64_t interpid) else { prev->next = next; } + if (next == NULL) { + queue->items.last = prev; + } queue->items.count -= 1; } else {