RUSTSEC-2026-0204: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

Nobody has claimed this yet.

> Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `crossbeam-epoch` |
| Version | `0.9.18` |
| URL | [https://github.com/crossbeam-rs/crossbeam/pull/1276](https://github.com/crossbeam-rs/crossbeam/pull/1276) |
| Date | 2026-07-06 |
| Patched versions | `>=0.9.20` |
| Unaffected versions | `<0.9.0` |

Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0204.html) for additional details.

Start with the linked crossbeam-rs/crossbeam pull request and the RustSec advisory page to understand the reported invalid pointer dereference and patched versions. Then inspect cargo-chef's dependency resolution to determine whether crossbeam-epoch 0.9.18 is included; done means the affected version is no longer resolved and the advisory is addressed.

Written by the indexing model from the issue text.