RUSTSEC-2026-0204: Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

> Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `crossbeam-epoch` |
| Version | `0.9.18` |
| URL | [https://github.com/crossbeam-rs/crossbeam/pull/1276](https://github.com/crossbeam-rs/crossbeam/pull/1276) |
| Date | 2026-07-06 |
| Patched versions | `>=0.9.20` |
| Unaffected versions | `<0.9.0` |

Affected versions of `fmt::Display` dereference the underlying pointer. This causes a invalid pointer dereference e.g., when a pointer created with `Atomic::null` or `Shared::null`. `fmt::Debug` impls and pre-0.9 `fmt::Display` impls, which do not dereference pointers, are not affected by this issue.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0204.html) for additional details.

Inspect the Rust dependency manifest and lockfile to find the crossbeam-epoch version in use. Update it to a patched version at or above 0.9.20, then run the repository's Rust test suite and confirm the vulnerable dependency is no longer selected.

Written by the indexing model from the issue text.