Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99042— io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已被修复： io_uring/net：为 24 字节的 sockaddr_in6 填充 CONNECT 过滤器字段函数仅在（即 28 字节）时，才会为填充和。然而，IPv6 的 connect 路径接受（24 字节），该长度已包含和字段。函数将原样传递给 socket 层。当为 24 字节时，过滤器看到的为，但端口和地址均为零，而内核实际连接的是真实的目标地址。这导致旨在拒绝特定 IPv6 端口或地址的过滤器被绕过。例如，拒绝的规则在为 28 字节时

CVSS 8.4 · High EPSS 0.21% · P11 Updated Oct 24, 2026

Possible ATT&CK Techniques 3 AI

T1070 · Indicator Removal T1222 · File and Directory Permissions Modification T1069 · Permission Groups Discovery

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`899bea8248cee35d54760a5e7d61a76af8e64411< 596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5`	affected
		`899bea8248cee35d54760a5e7d61a76af8e64411< aa5d5f8e502318e783545ba5d04bb40130b83e20`	affected
		`7.2`	affected
		`< 7.2`	unaffected
		`7.2.11≤ 7.2.*`	unaffected
		`7.3≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len >= sizeof(struct sockaddr_in6), i.e. 28 bytes. The IPv6 connect paths accept SIN6_LEN_RFC2133 (24 bytes), which already holds sin6_port and sin6_addr. io_connect() passes addr_len to the socket layer unchanged. At addr_len 24 the filter sees family AF_INET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.port == P rejects [::1]:P with -EACCES at addr_len 28 but connects at addr_len 24. Use SIN6_LEN_RFC2133 as the threshold. sin6_scope_id stays zero when absent. The threshold mismatch was found by an AI coding assistant (Claude Code) comparing this hook against the net/ipv6 length checks on my instructions; it also drafted the reproducer and this patch. I verified the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same code.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	899bea8248cee35d54760a5e7d61a76af8e64411 ~ 596a955d2d01b7e29d9fed60ebcf7c4ba518b8e5	-
Linux	Linux	7.2	-

II. Public POCs for CVE-2026-99042

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99042

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99042 (2)

https://www.cve.org/CVERecord?id=CVE-2026-99042

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-99054	7.8 HIGH	tipc: destroy topsrv workqueues before closing connections
CVE-2026-98944	7.8 HIGH	HID: steam: Refactor registration
CVE-2026-99032	7.8 HIGH	net/smc: protect clcsock lifetime in smc_getname
CVE-2026-98974	7.8 HIGH	xfs: fix exchange-range-to-eof file size exchange
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98975	7.8 HIGH	xfs: stop exchanging reflink flags when exchanging mappings
CVE-2026-98899	7.8 HIGH	netfilter: ipset: mark the rcu locked areas properly
CVE-2026-98976	7.8 HIGH	namespace: keep the lock on a mount that a propagated copy is moved beneath

Showing top 20 of 218 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux