CVE Watch20 ago 2026

CVE-2026-77584

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client coul

CVSS

7.0

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 20 ago 2026 · Última mod.: 20 ago 2026 · CWE-821

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025.

Referencias oficiales

gitlab.torproject.orghttps://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.9.10/ChangeLog

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-431989.8 CRÍ

22.5%

——7In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.32d