In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6… (CVE-2026-99042)

The vulnerability in the Linux kernel io_uring/net code stemmed from io_connect_bpf_populate() only filling connect.port and connect.v6_addr fields for AF_INET6 addresses when the address length was at least 28 bytes (sizeof(struct sockaddr_in6)). However, IPv6 connect paths accept sockaddr_in6 structures with a length of 24 bytes (SIN6_LEN_RFC2133), which already contain the port and address fields. At this shorter length, the filter incorrectly saw zeroed port and address, allowing connection filters that deny specific IPv6 ports or addresses to be bypassed. The patch changes the threshold to use SIN6_LEN_RFC2133 (24 bytes) to ensure the filter sees the correct connection details. This mismatch was discovered and initially drafted by an AI assistant and verified on kernel versions 7.2 and 7.3-rc6.

Filters that rely on the connect.port or connect.v6_addr fields to deny IPv6 connections could be bypassed if the sockaddr_in6 length was 24 bytes, potentially allowing unauthorized connections that should have been blocked by the filter. This could lead to unauthorized network connections bypassing security policies implemented via BPF connect filters.

A fix has been implemented in the Linux kernel to correct the length threshold used in io_connect_bpf_populate(), aligning it with SIN6_LEN_RFC2133 (24 bytes). Users should update to a kernel version that includes this patch (e.g., 7.3-rc6 or later). No additional mitigation is required beyond applying the official fix.