{"id":"CVE-2026-99042","state":"PUBLISHED","title":"io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port == P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode.","publishedAt":"2026-10-23T12:22:01.804Z","updatedAt":"2026-10-24T14:10:09.161Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"899bea8248cee35d54760a5e7d61a76af8e64411","status":"affected","lessThan":"596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5","versionType":"git"},{"version":"899bea8248cee35d54760a5e7d61a76af8e64411","status":"affected","lessThan":"aa5d5f8e502318e783545ba5d04bb40130b83e20","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.2","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/net.c"]}],"references":["https://git.kernel.org/stable/c/596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5","https://git.kernel.org/stable/c/aa5d5f8e502318e783545ba5d04bb40130b83e20"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/99xxx/CVE-2026-99042.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99042","state":"PUBLISHED","datePublished":"2026-10-23T12:22:01.804Z","dateUpdated":"2026-10-24T14:10:09.161Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.387Z"},"containers":{"cna":{"title":"io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6\n\nio_connect_bpf_populate() fills connect.port and connect.v6_addr for\nAF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28\nbytes.\n\nThe IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which\nalready holds sin6_port and sin6_addr. io_connect() passes addr_len to\nthe socket layer unchanged.\n\nAt addr_len 24 the filter sees family AF_INET6 with port and address\nzero, while the kernel connects to the real destination. A filter that\ndenies an IPv6 port or address is bypassed. Denying connect.port == P\nrejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24.\n\nUse SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when\nabsent.\n\nThe threshold mismatch was found by an AI coding assistant (Claude Code)\ncomparing this hook against the net/ipv6 length checks on my\ninstructions; it also drafted the reproducer and this patch. I verified\nthe bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same\ncode."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"899bea8248cee35d54760a5e7d61a76af8e64411","status":"affected","lessThan":"596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5","versionType":"git"},{"version":"899bea8248cee35d54760a5e7d61a76af8e64411","status":"affected","lessThan":"aa5d5f8e502318e783545ba5d04bb40130b83e20","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"7.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.2","versionType":"semver"},{"version":"7.2.11","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["io_uring/net.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5"},{"url":"https://git.kernel.org/stable/c/aa5d5f8e502318e783545ba5d04bb40130b83e20"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - An attacker reaches the patched io_connect_bpf_populate() by locally submitting IORING_OP_CONNECT through io_uring_enter(), with sqe->addr2 supplying the malicious 24-byte length. No network packet carries the value creating the mismatch.\nAC:L - Against a CONNECT filter denying an IPv6 port or address, addr2=24 deterministically makes io_connect_bpf_populate() expose zero port/address while tcp_v6_connect() accepts and uses the real fields; no race or uncontrolled condition is involved.\nPR:L - No capability check exists in io_uring_enter(), io_connect_prep(), or io_connect(), and AF_INET6 SOCK_STREAM creation avoids inet6_create()'s CAP_NET_RAW check. An ordinary confined process with access to the filtered ring can trigger the bypass.\nUI:N - The confined process prepares and submits the 24-byte sockaddr itself, and io_connect_prep() copies it during io_uring_enter(); no other user must mount, open, approve, or otherwise act.\nS:C - The false port/address view escapes the io_uring BPF CONNECT sandbox: __io_uring_run_bpf_filters() allows an operation that an inherited or ring-level filter intended to deny, reaching network resources outside that policy scope.\nC:H - After the filter sees :: and port 0, tcp_v6_connect() uses sin6_addr and sin6_port from the same 24 bytes; the confined process can establish a full socket and read responses from IPv6 services the CONNECT filter explicitly made inaccessible.\nI:H - tcp_v6_connect() stores the hidden destination in sk_v6_daddr and inet_dport and establishes the denied socket, enabling arbitrary application data and requests to be sent to IPv6 services and ports prohibited by the sandbox policy.\nA:N - The bug only substitutes zero values in the filter context; move_addr_to_kernel() safely copies 24 bytes and the IPv6 socket layer accepts that size. It introduces no corruption, out-of-bounds access, oops, hang, or resource exhaustion."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-24T14:10:09.161Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.2.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"7.2","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}