CVE-2026-99042

What it actually does

io_connect_bpf_populate() only populates connect.port and connect.v6_addr for AF_INET6 when addr_len is at least 28 bytes; 24-byte SIN6_LEN_RFC2133 structures are accepted by the IPv6 connect path but leave the BPF filter fields zeroed, so a filter that denies a specific port or address sees family AF_INET6 with zeros and allows the operation while the kernel performs the real connect.

Why it matters to the business

Local processes can bypass network egress controls enforced by BPF filters attached to io_uring, enabling unauthorized outbound connections that should have been blocked and increasing the chance of data exfiltration or command-and-control from systems that rely on these filters.

How an attack unfolds

An attacker with local access issues an io_uring connect request using a 24-byte sockaddr_in6 structure targeting a port or address that the BPF filter is configured to deny; the filter receives zeroed fields and permits the request while the kernel connects to the intended destination, completing the bypass without triggering the expected -EACCES.

How to fix it

Upgrade the Linux kernel to a version containing the fix that changes the threshold check in io_connect_bpf_populate() to use SIN6_LEN_RFC2133 (24 bytes) and ensures sin6_scope_id is handled correctly; rebuild and reboot systems using the updated kernel; until patches are available, restrict untrusted local users from using io_uring or disable the affected BPF programs.

How to confirm the fix worked

Confirm the running kernel contains the corrected length check (addr_len >= sizeof(struct sockaddr_in6) replaced by the RFC2133 constant); test with a reproducer that performs a 24-byte IPv6 connect to a filtered destination and verify the filter now receives the correct port and address fields.

Typical attack path

1. Obtain local code execution or shell on the target system
2. Prepare an io_uring submission queue entry for IORING_OP_CONNECT with addr_len set to 24
3. Supply a sockaddr_in6 containing the desired IPv6 address and port
4. Submit the request; the BPF filter evaluates zeroed fields and allows it
5. Kernel performs the actual connect to the real destination

How to detect it

Search kernel logs and audit trails for io_uring connect operations that succeed when a BPF filter should have denied them; look for processes using IORING_OP_CONNECT with IPv6 addresses and unusually small address lengths; correlate with unexpected outbound IPv6 connections from processes that should be restricted.

What your security team should do

• Prioritize kernel updates on any system exposing io_uring to untrusted local users or running restrictive BPF connect filters
• Audit local applications and containers that use io_uring networking operations
• Consider temporary mitigation via seccomp or LSM policies that limit io_uring use until patches are deployed