CVE-2026-99042 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers using io_uring/net in their infrastructure or applications should assess exposure and apply patches to prevent potential bypass of IPv6 connect filters.

Why it matters

CVE-2026-99042 is a high-severity vulnerability in the Linux kernel's io_uring/net component that allows bypassing of IPv6 connect filters. Linux system administrators and security teams should assess exposure and apply patches to prevent potential exploitation. The vulnerability requires verification of system inventory and patch levels.

• Bypassing of IPv6 connect filters may allow unauthorized connections
• Potential for exploitation requires verification from official sources
• Patching is required to fix the vulnerability
• Verification of system inventory and patch levels is necessary

Technical summary

The io_connect_bpf_populate function in the Linux kernel's io_uring/net component does not properly populate the connect.port and connect.v6_addr fields for AF_INET6 when using a 24-byte sockaddr_in6 address structure. This allows bypassing of IPv6 connect filters. The fix involves using SIN6_LEN_RFC2133 as the threshold for populating these fields, ensuring that filters based on port or address are correctly applied even with the smaller address structure. A filter that denies a specific IPv6 port or address can be bypassed because the current implementation only populates these fields for AF_INET6 when the address length is at least sizeof(struct sockaddr_in6), which is 28 bytes. Linux system administrators,

Defensive priority

Assess exposure and apply patches for Linux kernel versions 7.2 and earlier. Verify inventory for affected systems and prioritize patching for critical infrastructure.

Recommended defensive actions

• Assess exposure for Linux kernel versions 7.2 and earlier
• Apply patches for affected Linux kernel versions
• Verify inventory for systems using io_uring/net
• Prioritize patching for critical infrastructure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was found by an AI coding assistant comparing the io_uring/net hook against net/ipv6 length checks. A reproducer and patch were drafted by the assistant, and the bypass and fix were verified in a VM on 7.3-rc6 and 7.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.