# UNDF: UNDF-2026-000000772
diff --git a/compiler/rustc_middle/src/ty/context.rs b/compiler/rustc_middle/src/ty/context.rs
--- a/compiler/rustc_middle/src/ty/context.rs
+++ b/compiler/rustc_middle/src/ty/context.rs
@@ -1,6 +1,7 @@
 // (existing imports near top of file)
+use rustc_data_structures::fx::FxHashSet;

 // ... (lines omitted for brevity) ...

     /// Checks to see if the caller (`body_features`) has all the features required by the callee
     /// (`callee_features`).
     pub fn is_target_feature_call_safe(
         self,
         callee_features: &[TargetFeature],
         body_features: &[TargetFeature],
     ) -> bool {
-        // If the called function has target features the calling function hasn't,
-        // the call requires `unsafe`. Don't check this on wasm
-        // targets, though. For more information on wasm see the
-        // is_like_wasm check in hir_analysis/src/collect.rs
-        self.sess.target.options.is_like_wasm
-            || callee_features
-                .iter()
-                .all(|feature| body_features.iter().any(|f| f.name == feature.name))
+        // If the called function has target features the calling function hasn't,
+        // the call requires `unsafe`. Don't check this on wasm
+        // targets, though. For more information on wasm see the
+        // is_like_wasm check in hir_analysis/src/collect.rs
+        //
+        // CWE-407 fix: build a HashSet from body_features once → O(C+B) instead of O(C×B).
+        // At C=B=50 features (realistic for AVX-512 heavy code) the old code did 2500
+        // name comparisons per call site; the new code does 100.
+        self.sess.target.options.is_like_wasm || {
+            let body_set: FxHashSet<Symbol> =
+                body_features.iter().map(|f| f.name).collect();
+            callee_features.iter().all(|f| body_set.contains(&f.name))
+        }
     }