Linux Kernel CVE-2026-99042

Exploitation requires (1) a Linux 7.2/7.3 kernel whose io_uring CONNECT BPF filtering (io_connect_bpf_populate) is actually in use as a security boundary, (2) a BPF filter that denies specific IPv6 ports or addresses, and (3) a local, low-privileged process able to submit io_uring operations. The trigger is specific and described in the source: the attacker issues an AF_INET6 connect through io_uring with addr_len = 24 (SIN6_LEN_RFC2133) rather than >= 28, so io_connect_bpf_populate() leaves connect.port and connect.v6_addr zero while io_connect() passes the real addr_len to the socket layer. Limiting factors: the vulnerability is inert unless such an io_uring connect filter is deployed, it affects only the AF_INET6 path, and it needs local authenticated access to issue the syscall - there is no remote or unauthenticated vector.

The input CVSS of 8.4 is driven mainly by the scope change (S:C) and C:H/I:H, but the base vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N describes a LOCAL, authenticated (PR:L), low-complexity flaw - not a remotely reachable one. The exploitation-probability signals are low and consistent with each other: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit is identified in the provided references (only stable-tree commits and the NVD advisory). The one elevating signal is the vuln.today 'this_week' decision label, indicating it should be patched promptly but is not flagged act_now/emergency. The practical risk is narrow and conditional: this is a security-policy (BPF connect filter) bypass that only has impact where an io_uring CONNECT BPF filter is actually deployed as a confinement boundary on kernel 7.2/7.3 - a brand-new feature with little production footprint today. Note the tension between the high CVSS/scope-change rating and the very specific, low-prevalence precondition plus local-only vector: this is better read as a high-severity-but-situational hardening fix than a broadly exploitable priority. No KEV or public exploit contradicts any claim of active exploitation.

A locally running, low-privileged process that is supposed to be confined by an io_uring BPF connect filter crafts an AF_INET6 CONNECT submitted through io_uring using a 24-byte sockaddr_in6 (SIN6_LEN_RFC2133) instead of the full 28-byte structure. The filter hook then evaluates family AF_INET6 with port and address read as zero and allows the call, while the kernel connects to the real, filter-denied destination (e.g. [::1]:P), bypassing the egress policy. The reporter states a reproducer was drafted and the bypass verified in a VM, but no public exploit code is referenced in the available data.