{"id":"CVE-2026-99042","kind":"vulnerability","aliases":["CVE-2026-99042"],"related":[],"title":"Linux kernel: io_uring connect filter can be bypassed with 24-byte IPv6 address","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port == P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.","summary":"In the Linux kernel's io_uring connect path, the BPF filter reads port and address fields only when the IPv6 sockaddr is 28 bytes, so a 24-byte sockaddr_in6 makes the filter see zero values. An attacker can therefore connect to a denied IPv6 port or address that the filter was meant to block.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","io_uring","linux-kernel","self-hosted"],"not_affected_if":["default-config","no-io-uring-connect-filter"],"how_to_check":"- Run `uname -r` and compare with the fixed kernel versions listed by the source (unknown in the sources provided).\n- Check whether io_uring connect filters (BPF) are used in your environment; the sources do not say how to detect this otherwise.","fix":"- Update the Linux kernel to a release containing the upstream commit that uses SIN6_LEN_RFC2133 as the threshold (fixed version: unknown in the sources).\n- The sources report that 7.2 has the same code and 7.3-rc6 was tested; the stable fixed version is unknown.","status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:14+00:00","updated_at":"2026-10-25T04:54:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:54:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release containing the upstream commit that uses SIN6_LEN_RFC2133 as the threshold (fixed version: unknown in the sources).\n- The sources report that 7.2 has the same code and 7.3-rc6 was tested; the stable fixed version is unknown.","reach":"local","title":"Linux kernel: io_uring connect filter can be bypassed with 24-byte IPv6 address","impact":"medium","summary":"In the Linux kernel's io_uring connect path, the BPF filter reads port and address fields only when the IPv6 sockaddr is 28 bytes, so a 24-byte sockaddr_in6 makes the filter see zero values. An attacker can therefore connect to a denied IPv6 port or address that the filter was meant to block.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","io_uring","bpf","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A denied IPv6 connection succeeds, bypassing the connect filter policy","analyst_note":"Confirm the affected and fixed kernel versions and whether the fix is in a stable release, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99042 and the upstream kernel commit.","how_to_check":"- Run `uname -r` and compare with the fixed kernel versions listed by the source (unknown in the sources provided).\n- Check whether io_uring connect filters (BPF) are used in your environment; the sources do not say how to detect this otherwise.","needs_analyst":true,"not_affected_if":["no-io-uring-connect-filter","default-config"],"who_is_affected":"Only systems that load a BPF filter on io_uring connect operations and rely on it to deny IPv6 ports or addresses are meaningfully exposed. Systems that do not use io_uring connect filters for access control are unlikely to be affected by the bypass.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000723,"input_tokens":3674,"output_tokens":712,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-99042':17A,20A '1':196C '24':11A,58B,104C,138C,161C,209C '28':54B,128C,203C '7.2':270C '7.3':266C 'absent':223C 'accept':134C 'addr':121C,147C,151C,159C,201C,207C 'address':14A,46B,79B,171C,189C 'af':117C,166C 'ai':231C 'alreadi':141C 'also':248C 'assist':233C 'attack':69B 'block':86B 'bpf':21B,41B,110C 'bypass':9A,191C,258C 'byte':12A,55B,59B,105C,129C,139C 'check':243C 'claud':234C 'code':232C,235C,274C 'compar':236C 'connect':5A,38B,72B,100C,109C,132C,149C,176C,205C 'connect.port':113C,193C 'connect.v6_addr':115C 'cve':15A,18A 'deni':75B,184C,192C 'destin':180C 'draft':249C 'eacc':199C 'famili':165C 'field':47B,102C 'fill':112C 'filter':6A,42B,64B,82B,101C,163C,182C 'fix':261C 'follow':92C 'found':228C 'hold':142C 'hook':238C 'host':30B 'i.e':127C 'id':219C 'in6':61B,107C,126C 'inet6':118C,167C 'infrastructur':22B 'instruct':246C 'io':3A,23B,36B,97C,108C,148C 'ipv6':13A,51B,76B,131C,186C 'kernel':2A,27B,34B,90C,175C 'layer':156C 'len':122C,136C,152C,160C,202C,208C,212C 'length':242C 'linux':1A,26B,33B,89C 'linux-kernel':25B 'make':62B 'meant':84B 'mismatch':226C 'net/ipv6':241C 'p':194C,197C 'pass':150C 'patch':254C 'path':39B,133C 'popul':99C,111C 'port':44B,77B,144C,169C,187C 'rc6':267C 'read':43B 'real':179C 'reject':195C 'reproduc':251C 'resolv':96C 'rfc2133':137C,213C 'scope':218C 'see':65B,164C 'self':29B 'self-host':28B 'sin6':135C,143C,146C,211C,217C 'sizeof':123C 'sockaddr':52B,60B,106C,125C 'socket':155C 'stay':220C 'struct':124C 'therefor':71B 'threshold':216C,225C 'unchang':157C 'ure':4A,24B,37B 'uring/net':98C 'use':210C 'valu':67B 'verifi':256C 'vm':264C 'vulner':93C 'zero':66B,172C,221C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load a BPF filter on io_uring connect operations and rely on it to deny IPv6 ports or addresses are meaningfully exposed. Systems that do not use io_uring connect filters for access control are unlikely to be affected by the bypass.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99042","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}