Live › vulnerability › CVE-2026-99042
Go to dashboardIn the Linux kernel's io_uring connect path, the BPF filter reads port and address fields only when the IPv6 sockaddr is 28 bytes, so a 24-byte sockaddr_in6 makes the filter see zero values. An attacker can therefore connect to a denied IPv6 port or address that the filter was meant to block.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load a BPF filter on io_uring connect operations and rely on it to deny IPv6 ports or addresses are meaningfully exposed. Systems that do not use io_uring connect filters for access control are unlikely to be affected by the bypass.
No product ranges from the sources yet.
uname -r and compare with the fixed kernel versions listed by the source (unknown in the sources provided).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes.
The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which already holds sin6_port and sin6_addr. io_connect() passes addr_len to the socket layer unchanged.
At addr_len 24 the filter sees family AF_INET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.port == P rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.
Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when absent.
The threshold mismatch was found by an AI coding assistant (Claude Code) comparing this hook against the net/ipv6 length checks on my instructions; it also drafted the reproducer and this patch. I verified the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same code.
This page as .md · .json · in your agent: get_signal("CVE-2026-99042")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.