CVE-2026-77641 is a memory-safety defect in Tor's CONFLUX protocol implementation where the relay ignores the return value from relay_send_command_from_edge() in the CONFLUX_SWITCH handler. The critical detail the CVE description omits: when this send call fails, it internally invokes circuit_mark_for_close(), which calls cfx_del_leg() to remove the circuit leg underneath the caller. The handler then continues executing with an invalidated leg reference, leading to a use-after-free crash.
This is not simply a case of neglected error handling. The function performs invisible state mutation that the caller has no mechanism to detect. Anyone reviewing the CONFLUX_SWITCH handler would see apparently valid code — the return value check is absent, but there's no obvious indicator that the function can invalidate the circuit state out from under the caller. The coupling between send failure and leg invalidation exists in a function two levels down the call stack and is never documented in relay_send_command_from_edge()'s interface.
The CONFLUX protocol extension compounds this vulnerability. CONFLUX deliberately maintains multiple parallel legs per circuit with dynamic switching capabilities — circuit state is inherently more fluid than traditional Tor circuits. This design choice maximizes the blast radius of any implicit state mutation, because the same circuit object now holds more interdependent state across what appear to be independent execution paths.
You should audit your Tor codebase for other callers of relay_send_command_from_edge() that ignore its return value. If they exist, they likely contain the same dormant defect — the specific failure condition may be hard to trigger, but the vulnerability class is not unique to this handler. Consider whether relay_send_command_from_edge() should document its internal side effects, or whether callers should be required to check the return value via static analysis. The low EPSS score (0.00194) suggests this isn't currently weaponized, but the crash pattern raises the question of whether a network adversary could trigger the send failure deterministically — this is worth investigating if you're modeling relay-level DoS vectors.