CVE-2026-99042

In the Linux kernel, the following vulnerability has been resolved:

io uring/net: populate CONNECT filter fields for 24-byte sockaddr in6

io connect bpf populate() fills connect.port and connect.v6 addr for AF INET6 only when addr len >= sizeof(struct sockaddr in6), i.e. 28 bytes.

The IPv6 connect paths accept SIN6 LEN RFC2133 (24 bytes), which already holds sin6 port and sin6 addr. io connect() passes addr len to the socket layer unchanged.

At addr len 24 the filter sees family AF INET6 with port and address zero, while the kernel connects to the real destination. A filter that denies an IPv6 port or address is bypassed. Denying connect.port == P rejects [::1]:P with -EACCES at addr len 28 but connects at addr len 24.

Use SIN6 LEN RFC2133 as the threshold. sin6 scope id stays zero when absent.

The threshold mismatch was found by an AI coding assistant (Claude Code) comparing this hook against the net/ipv6 length checks on my instructions; it also drafted the reproducer and this patch. I verified the bypass and the fix in a VM on 7.3-rc6 and that 7.2 has the same code.