CHERI is one of the most influential hardware-security projects of the past decade. Its core idea is to introduce capabilities into the CPU: every pointer is no longer just a memory address, but a bounded, unforgeable authorization token. Pointers cannot access out-of-bounds memory and cannot be forged. This solves spatial safety (buffer overflows, etc.). But temporal safety—use-after-free—has never been fully solved.
Use-after-free is subtle. After memory is freed and reallocated to another object, a stale pointer may linger in a cache. The old pointer still points to that memory, but the data now belongs to someone else. Reading stale data is an information leak; writing to it is memory corruption. Worse, the window between free and reallocation is too short to be covered by software-level checks.
Building on the University of Cambridge team's years of CHERI work, Wang, Woodruff, and colleagues propose a hardware capability-format extension: PoisonCap. The core idea is to add a "poisoned" state flag to every capability. When memory is freed, the system does not zero the pointer—instead, the corresponding capability is marked as poisoned. The pointer still exists, its bounds remain, but any memory access through the poisoned capability triggers a hardware exception.
How poison propagates
The question is: how does poisoning information spread? PoisonCap leverages CHERI's existing capability-bound layering. An upper-level allocator holds a capability for the whole memory block; lower-level allocators derive restricted sub-capabilities from it. When the upper allocator poisons a capability, all derived capabilities in the lower allocator are automatically poisoned too—no level-by-level notification required. This guarantees the safety of an entire subtree in nested-allocator scenarios.
Implementation and performance
In terms of implementation, PoisonCap can replace Cornucopia's shadow-bitmap scheme. Freed memory is automatically zeroed, or traps fire before reads or writes. Compared with the current best-known solution, Cornucopia, PoisonCap provides stronger use-after-free protection while adding zero performance overhead—no increase in baseline latency.
Open questions
- Poisoned state requires extra hardware storage—exactly how many additional register bits and metadata are needed?
- The paper mentions "hierarchical" propagation but does not analyze the time overhead of poison propagation in multi-level allocator scenarios.
- The behavior of poisoned capabilities under cache-coherency protocols is not discussed.
References
1. Wang, Y., Woodruff, J., Mazzinghi, A., et al. (2026). *PoisonCap: Efficient Hierarchical Temporal Safety for CHERI*. arXiv:2605.13210 [cs.AR]. 2. Watson, R. N. M., et al. (2015). *CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization*. IEEE S&P. 3. Woodruff, J., et al. (2024). *Cornucopia Reloaded: Efficient Temporal Memory Safety for CHERI*. ISCA.