python
diff --git a/‎Lib/test/_test_atexit.py‎
Lines changed: 13 additions & 0 deletions b/‎Lib/test/_test_atexit.py‎
Lines changed: 13 additions & 0 deletions
diff --git a/‎Misc/ACKS‎
Lines changed: 1 addition & 0 deletions b/‎Misc/ACKS‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎Misc/NEWS.d/next/Library/2025-12-17-14-41-09.gh-issue-112127.13OHQk.rst‎
Lines changed: 2 additions & 0 deletions b/‎Misc/NEWS.d/next/Library/2025-12-17-14-41-09.gh-issue-112127.13OHQk.rst‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎Modules/atexitmodule.c‎
Lines changed: 2 additions & 1 deletion b/‎Modules/atexitmodule.c‎
Lines changed: 2 additions & 1 deletion
@@ -135,6 +135,19 @@ def func():
         finally:
             atexit.unregister(func)
 
+    def test_eq_unregister_clear(self):
+        # Issue #112127: callback's __eq__ may call unregister or _clear
+        class Evil:
+            def __eq__(self, other):
+                action(other)
+                return NotImplemented
+
+        for action in atexit.unregister, lambda o: atexit._clear():
+            with self.subTest(action=action):
+                atexit.register(lambda: None)
+                atexit.unregister(Evil())
+                atexit._clear()
+
 
 if __name__ == "__main__":
     unittest.main()
@@ -908,6 +908,7 @@ Jim Jewett
 Pedro Diaz Jimenez
 Orjan Johansen
 Fredrik Johansson
+Benjamin Johnson
 Benjamin K. Johnson
 Gregory K. Johnson
 Kent Johnson
 
@@ -0,0 +1,2 @@
+Fix possible use-after-free in :func:`atexit.unregister` when the callback
+is unregistered during comparison.
@@ -257,10 +257,11 @@ static int
 atexit_unregister_locked(PyObject *callbacks, PyObject *func)
 {
     for (Py_ssize_t i = 0; i < PyList_GET_SIZE(callbacks); ++i) {
-        PyObject *tuple = PyList_GET_ITEM(callbacks, i);
+        PyObject *tuple = Py_NewRef(PyList_GET_ITEM(callbacks, i));
         assert(PyTuple_CheckExact(tuple));
         PyObject *to_compare = PyTuple_GET_ITEM(tuple, 0);
         int cmp = PyObject_RichCompareBool(func, to_compare, Py_EQ);
+        Py_DECREF(tuple);
         if (cmp < 0)
         {
             return -1;
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fix possible use-after-free in :func:`atexit.unregister` when the callback
	`2`	`+is unregistered during comparison.`
Original file line number	Diff line number	Diff line change
`@@ -257,10 +257,11 @@ static int`
`257`	`257`	`atexit_unregister_locked(PyObject callbacks, PyObject func)`
`258`	`258`	`{`
`259`	`259`	`for (Py_ssize_t i = 0; i < PyList_GET_SIZE(callbacks); ++i) {`
`260`		`- PyObject *tuple = PyList_GET_ITEM(callbacks, i);`
	`260`	`+ PyObject *tuple = Py_NewRef(PyList_GET_ITEM(callbacks, i));`
`261`	`261`	`assert(PyTuple_CheckExact(tuple));`
`262`	`262`	`PyObject *to_compare = PyTuple_GET_ITEM(tuple, 0);`
`263`	`263`	`int cmp = PyObject_RichCompareBool(func, to_compare, Py_EQ);`
	`264`	`+ Py_DECREF(tuple);`
`264`	`265`	`if (cmp < 0)`
`265`	`266`	`{`
`266`	`267`	`return -1;`