CVE-2026-77641: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-77641 is a write-after-free vulnerability in the Tor anonymity network software, tracked internally as TROVE-2026-017. It affects Tor versions from 0.4.8.1-alpha up to (but not including) 0.4.9.9, and was published on August 20, 2026. The flaw occurs in the CONFLUX_SWITCH cell handling logic, where a failed send operation can trigger a crash. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Tor ChangeLog).

The root cause is an unchecked return value (CWE-252) in Tor's CONFLUX protocol implementation. When relay_send_command_from_edge() fails while sending a CONFLUX_SWITCH cell, it internally calls circuit_mark_for_close(), which removes the circuit leg via cfx_del_leg() and frees the associated memory. Because the return value of relay_send_command_from_edge() is not checked by the caller, the failure goes undetected, and the caller subsequently writes to the now-freed memory (the current leg pointer), resulting in a NULL write-after-free and process crash. The attack vector is network-based with high complexity and requires no privileges or user interaction (GitHub Advisory, Tor ChangeLog).

Successful exploitation causes the Tor process to crash, resulting in a denial of service for any relay, bridge, or client running an affected version. There is no confidentiality impact, and integrity impact is assessed as low. Availability is the primary concern, as a crashed Tor node would disrupt anonymized traffic routing and could degrade the broader Tor network if exploited at scale against relay infrastructure (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires high attack complexity, as an attacker must be able to trigger a specific failure condition during CONFLUX_SWITCH cell transmission (GitHub Advisory).

• Process: Unexpected crashes or restarts of the tor process, particularly on nodes with CONFLUX (multi-path circuit) functionality enabled.
• Logs: Tor log entries indicating circuit closure errors or segmentation faults around CONFLUX_SWITCH cell processing; crash dump files generated by the Tor process.
• Network: Anomalous patterns of failed CONFLUX_SWITCH cell transmissions observed in Tor relay traffic logs.

Upgrade Tor to version 0.4.9.9 or later, which contains the fix for this vulnerability. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. Operators running Tor relays, bridges, or clients on versions 0.4.8.1-alpha through 0.4.8.x should prioritize this update. Monitor for unusual Tor process crashes as an interim detection measure (Tor ChangeLog, GitHub Advisory).