CVE-2026-77641

CVE-2026-77641 is a memory-safety defect in Tor's CONFLUX protocol implementation where the relay ignores the return value from `relay_send_command_from_edge()` in the CONFLUX_SWITCH handler. The critical detail the CVE description omits: when this send call fails, it internally invokes `circuit_mark_for_close()`, which calls `cfx_del_leg()` to remove the circuit leg underneath the caller. The handler then continues executing with an invalidated leg reference, leading to a use-after-free crash. This is not simply a case of neglected error handling. The function performs invisible state mutation that the caller has no mechanism to detect. Anyone reviewing the CONFLUX_SWITCH handler would see apparently valid code — the return value check is absent, but there's no obvious indicator that the function can invalidate the circuit state out from under the caller. The coupling between send failure and leg invalidation exists in a function two levels down the call stack and is never documented in `relay_send_command_from_edge()`'s interface. The CONFLUX protocol extension compounds this vulnerability. CONFLUX deliberately maintains multiple parallel legs per circuit with dynamic switching capabilities — circuit state is inherently more fluid than traditional Tor circuits. This design choice maximizes the blast radius of any implicit state mutation, because the same circuit object now holds more interdependent state across what appear to be independent execution paths. You should audit your Tor codebase for other callers of `relay_send_command_from_edge()` that ignore its return value. If they exist, they likely contain the same dormant defect — the specific failure condition may be hard to trigger, but the vulnerability class is not unique to this handler. Consider whether `relay_send_command_from_edge()` should document its internal side effects, or whether callers should be required to check the return value via static analysis. The low EPSS score (0.00194) suggests this isn't currently weaponized, but the crash pattern raises the question of whether a network adversary could trigger the send failure deterministically — this is worth investigating if you're modeling relay-level DoS vectors.

Reviewed through automated stages and approved by a human before publication.