CVE-2026-99042: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6

ioconnectbpfpopulate() fills connect.port and connect.v6addr for AFINET6 only when addrlen >= sizeof(struct sockaddrin6), i.e. 28 bytes.

The IPv6 connect paths accept SIN6LENRFC2133 (24 bytes), which already holds sin6port and sin6addr. ioconnect() passes addrlen to the socket layer unchanged.

At addrlen 24 the filter sees family AFINET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.port == P rejects [::1]:P with -EACCES at addrlen 28 but connects at addrlen 24.

Use SIN6LENRFC2133 as the threshold. sin6scopeid stays zero when absent.

The threshold mismatch was found by an AI coding assistant (Claude Code) comparing this hook against the net/ipv6 length checks on my instructions; it also drafted the reproducer and this patch. I verified the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same code.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:22 PM

Data Sourced

via MITRE·12:22 PM

Description

Frequently Asked Questions

Who is exposed to this bypass?

Systems that use io_uring CONNECT filtering with BPF policies that deny specific IPv6 destination ports or addresses are exposed. The bypass applies when an IPv6 connect request uses a 24-byte sockaddr_in6.

What does an attacker need to do to bypass the filter?

The attacker needs to issue an IPv6 connection through the affected io_uring path using a 24-byte sockaddr_in6. At that length, the filter receives zero values for the IPv6 address and port even though the kernel connects to the requested destination.

How can I tell whether a filter is affected?

A policy that denies a particular IPv6 address or port is affected if a normal 28-byte sockaddr_in6 connection is denied with -EACCES but an otherwise identical 24-byte request connects. The issue does not concern the scope ID, which remains zero when it is absent.

CVE-2026-99042: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to do to bypass the filter?

How can I tell whether a filter is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this bypass?

What does an attacker need to do to bypass the filter?

How can I tell whether a filter is affected?