IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux kernel: io_uring CONNECT filter bypass via 24-byte IPv6 sockaddr

CVE-2026-99042High 8.4

← All vulnerabilities

Summary

The io_uring BPF filter for CONNECT requests does not read the port and address of IPv6 destinations when the sockaddr length is 24 bytes (SIN6_LEN_RFC2133). The kernel still connects to the real destination, so a policy that denies an IPv6 port or address can be bypassed. The attacker needs local code execution with low privileges, and the issue only matters where such a BPF filter is in use.

Affected

  • Linux kernel 7.2 branch (OSV: introduced in 7.2.0, fixed in 7.2.11)
  • Per the CNA record, commit 899bea8248cee35d54760a5e7d61a76af8e64411 onward until the fix commits
  • Distribution kernels: Unknown.

Fixed in

  • Linux kernel 7.2.11 or later on the 7.2 branch
  • Stable fix commits: 596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5 and aa5d5f8e502318e783545ba5d04bb40130b83e20
  • Distribution fixed versions: Unknown.

Workaround

  • Remove or fix io_uring-based BPF filters on CONNECT if they are not needed
  • Restricting io_uring system-wide via kernel.io_uring_disabled is an option if the workload allows it.

Exploitation

  • Exploitation in the wild: No evidence found.
  • A public third-party research repository describes the bypass and reports reproduction in a VM. No reproduction steps are included here.
  • EPSS: 0.0016 (very low).
  • CVSS 3.1 8.4 (High) per the CNA; the attack vector is local.

Our recommendation

  • Check whether io_uring BPF filters on CONNECT are used on your hosts; if not, the issue does not affect you.
  • Apply the vendor kernel update containing the fix as part of normal kernel patching.
  • Prioritise hosts that run untrusted local code or shared multi-tenant Linux systems.
  • Monitor your distribution's tracker for the fixed kernel package.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:06.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes. The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which already holds sin6_port and sin6_addr. io_connect() passes addr_len to the socket layer unchanged. At addr_len 24 the filter sees family AF_INET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.port == P rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24. Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when absent. The threshold mismatch was found by an AI coding assistant (Claude Code) comparing this hook against the net/ipv6 length checks on my instructions; it also drafted the reproducer and this patch. I verified the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same code.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed