---
id: CVE-2026-99042
title: 'io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

  io_connect_bpf_populate() fills connect.port and connect.v6_addr for
  AF_INET6 only when addr_len …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 899bea8248cee35d54760a5e7d61a76af8e64411 <
    596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5
  - >-
    Linux >= 899bea8248cee35d54760a5e7d61a76af8e64411 <
    aa5d5f8e502318e783545ba5d04bb40130b83e20
  - Linux 7.2
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:22:01.804Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99042'
references:
  - url: 'https://git.kernel.org/stable/c/596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5'
  - url: 'https://git.kernel.org/stable/c/aa5d5f8e502318e783545ba5d04bb40130b83e20'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

io_connect_bpf_populate() fills connect.port and connect.v6_addr for
AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28
bytes.

The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which
already holds sin6_port and sin6_addr. io_connect() passes addr_len to
the socket layer unchanged.

At addr_len 24 the filter sees family AF_INET6 with port and address
zero, while the kernel connects to the real destination. A filter that
denies an IPv6 port or address is bypassed. Denying connect.port == P
rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.

Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when
absent.

The threshold mismatch was found by an AI coding assistant (Claude Code)
comparing this hook against the net/ipv6 length checks on my
instructions; it also drafted the reproducer and this patch. I verified
the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same
code.

## Affected

- `Linux >= 899bea8248cee35d54760a5e7d61a76af8e64411 < 596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5`
- `Linux >= 899bea8248cee35d54760a5e7d61a76af8e64411 < aa5d5f8e502318e783545ba5d04bb40130b83e20`
- `Linux 7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.