ADVERTISEMENT

Tails Linux critical vulnerability allows websites to deanonymize users: emergency patch available

The exploit can be leveraged by state-sponsored attackers or hacking firms.

Tails Linux

Image by Cybernews.

Ernestas Naprys
Ernestas Naprys Senior Journalist
August 5, 2026 Updated: 21 minutes ago 2 min read
Key takeaways:
  • Tails fixed a critical Linux flaw that let malicious websites seize control and deanonymize users.
  • Users should upgrade immediately to version 7.10.1; earlier Tails releases remain vulnerable.
  • Tor Project says sophisticated attackers could exploit the flaw, but no attacks have been observed.

Key Takeaways by nexos.ai, reviewed by Cybernews staff.

Tails, a security and anonymity-focused portable Linux distribution that keeps no records of user activity, has fixed a critical kernel vulnerability. Simply visiting a malicious website could deanonymize the user.

Tails, or The Amnesic Incognito Live System, is urging users to upgrade to version 7.10.1 as soon as possible, because previous versions are affected by a critical kernel vulnerability tracked as CVE-2026-64560.

Tor Project warns that it allows Tor Browser to gain administrator privileges on the system. Therefore, a malicious website could take full control of Tails and deanonymize users.

“This attack is very unlikely but could be performed by a strong attacker, such as a government or a hacking firm. We are not aware of this attack being used in practice until now,” the Tor Project said in a blog post.

More from Cybernews

NPM worm attack
Another massive NPM worm: 444 packages with 2 billion monthly downloads infected with malware
Security 3 min read
credit agricole phishing scheme
The bizarre Credit Agricole phishing campaign: how the scammers did it
Security 5 min read
Tor netowrk
Tor launches new Android app for volunteers to share their internet connections and help millions to access the open internet
Security 3 min read
malware device passkeys
Google’s synced passkeys can be easily stolen with basic malware, researchers find
Security 5 min read
Georgia water towers
Michigan, Georgia confirm public water system attacks linked to Iranian hacking spree
Security 3 min read
Bank money transfer on a payments app
Businesses stop accepting screenshots as proof after AI makes fake bank transfers too easy
Security 2 min read

Users, such as activists or journalists, who try to hide their identities or avoid censorship, prefer to load Tails from a USB stick rather than a storage device – the OS leaves no traces on disk after shutting down. It can, however, store some persistent files on the USB stick itself, such as documents, emails, or additional software. Tor Browser is built in for secure access to the internet.

ADVERTISEMENT

First disclosed last week, the bug has been lurking in the Linux kernel since version 5.7, released on May 31st, 2020. The flaw affects Linux’s POSIX CPU timer subsystem, causing a rare race condition to occur in edge cases.

Tails update also fixes other vulnerabilities that could allow different applications in the OS to gain administrator privileges.

“For example, if an attacker tricks you into opening a malicious file in an application that uses expat, such as LibreOffice, Audacity, or Git, they might then use one of these vulnerabilities to take full control of your Tails and deanonymize you,” the advisory warns.

Again, such an attack is very unlikely and can potentially be pulled off against very valuable targets by nation-states or other sophisticated attackers. No exploitation in the wild has been observed.

Tails can be upgraded automatically or manually to preserve the “Persistent Storage” on the USB drive. Reinstalling the OS on the USB stick would wipe the data.

Ernestas Naprys
Ernestas Naprys
Senior Journalist

Ernestas Naprys is a senior journalist at Cybernews covering information security, open-source software, hardware, data breaches, vulnerabilities, hacking, and digital privacy. With 12 years of journalism experience, his reporting combines technical research with hands-on experimentation, helping readers understand complex cybersecurity risks and technologies. Before joining Cybernews, Ernestas worked as a financial markets reporter at Verslo Žinios and as a business journalist at 15min and DELFI. He was recognized as Lithuania's Journalist of the Year in 2018 for his analysis of EU investments.

ADVERTISEMENT