CVE-2026-77587

This CVE exposes a race condition in Tor's conflux multi-path routing system where recovery leg processing and leg closure can race on the same object, leading to a double-free. The key insight is that this is not a narrow timing bug — the vulnerability becomes structurally guaranteed when a conflux set degrades to its last leg through natural attrition, at which point a malicious exit node doesn't need precise timing to trigger the race. They simply wait for the set to reach its 'death throes' state (a single remaining leg), then initiate closure. The recovery code, designed and tested against healthy conflux sets with multiple active legs, was never audited for the degenerate case of reviving a set that has already closed its final leg. This explains why the bug exists despite Tor's existing NULL-check discipline — the code path was operationally rare in normal use and simply never modeled. The double-free is the diagnostic detail: it proves two independent code paths both reasoned about ownership enough to reach deallocation, indicating a coordination failure rather than first-order neglect. The fix is likely a simple state flag indicating 'closure in progress' that recovery code checks before attempting revival — not an architectural refactoring of Tor's object model. However, adding synchronization to recovery paths raises a secondary concern: Tor's anonymity depends on timing uniformity, so any lock or contention point could introduce detectable latency patterns that undermine the property conflux exists to protect. The fix must be evaluated for timing side channels. The CVSS 5.9 rating obscures a critical operational reality: any compromised relay can trigger this against every conflux-enabled client without timing cooperation. Since Tor's threat model already assumes malicious exit nodes, this vulnerability is effectively a reliable denial-of-service weapon with enormous reach — the severity should be re-evaluated through the lens of Tor's adversarial model rather than generic CVSS metrics. The broader question is whether this is an isolated bug or the first surfaced symptom of a systematic gap. Conflux is experimental, and its 'last leg' assumption likely exists in other code paths that haven't been exercised yet. The institutional pattern — experimental features shipping with lifecycle auditing deferred until a CVE surfaces — has repeated across Tor's introduction of stream isolation and introduction circuits. Treat this as a canary.

Reviewed through automated stages and approved by a human before publication.