The Tails Project has released Tails 7.10.1 as an emergency security update addressing critical vulnerabilities that could allow attackers to obtain administrator privileges, take control of the operating system, and potentially deanonymize users.
Released on August 5, 2026, the update patches a Linux kernel vulnerability tracked as CVE-2026-64560, as well as several security issues in the Expat XML-processing library. The developers said they are not aware of either attack being exploited in practice, but warned that well-resourced adversaries, including government agencies or commercial hacking firms, could potentially use them.
CVE-2026-64560 is a use-after-free vulnerability affecting the Linux kernel’s handling of POSIX CPU timers. The underlying race condition was reported by researchers identified in the kernel advisory as Wongi and Jungwoo.
In practical terms, the vulnerability could allow code running inside Tor Browser to escape its normal restrictions and gain administrator-level access to the Tails system. A malicious website would first need to exploit the browser or another component before using the kernel flaw to elevate its privileges.
Tails, short for The Amnesic Incognito Live System, is a privacy-focused Linux distribution designed to run from a USB drive. It routes internet traffic through the Tor anonymity network and is built to minimize traces left on the computer after shutdown. The operating system is used by journalists, activists, researchers, and others who may need additional protection against surveillance or device inspection.
Tails 7.10.1 upgrades the Linux kernel to version 6.12.100, which contains the fix for CVE-2026-64560. The technical issue involves a race condition that can occur when one thread in a process replaces the running program while another thread deletes or changes a CPU timer. Under certain conditions, the kernel may continue using memory after it has already been released, creating an opportunity for privilege escalation.
The release also updates Expat to version 2.8.2 to address vulnerabilities covered by Debian security advisory DSA-6404-1. Expat is a widely used library for processing XML data and is included in multiple applications available in Tails.
According to the project, an attacker could attempt to exploit these flaws by convincing a user to open a specially prepared file in an application that relies on Expat. Examples named in the announcement include LibreOffice, Audacity, and Git. Successful exploitation could again provide administrator privileges and potentially undermine the user’s anonymity.
The update includes two additional changes unrelated to the vulnerabilities. Automatic upgrades are now compressed using the Zstandard (zstd) format, which should reduce decompression time during startup. Tails has also removed unused firmware, making USB installation images and automatic upgrade packages approximately 70 MB smaller.
Automatic upgrades to Tails 7.10.1 are available for systems running Tails 7.0 or later. Users who cannot complete an automatic upgrade, or whose system fails to start afterward, are advised to perform a manual upgrade.
Leave a Reply