Linux kernel io_uring: IPv6 connect filters bypassed with a 24-byte sockaddr_in6

Impact

A local process can defeat egress policy enforced through the io_uring CONNECT filter hook. io_connect_bpf_populate() only filled connect.port and connect.v6_addr when addr_len was at least 28 bytes, but the IPv6 connect path accepts the 24-byte SIN6_LEN_RFC2133 form, which already carries the real port and address. At addr_len 24 the filter sees AF_INET6 with a zero port and zero address while the kernel completes the connection to the real destination, so a rule denying a port or address is silently skipped. On a GPU node this matters where the filter is the control keeping tenant workloads off the management VLAN, the fabric subnet, or a metadata or license endpoint: any tenant process that can call io_uring connect reaches those addresses anyway, and the policy still reports as enforced. Scored as a scope change because the bypass crosses the sandbox the filter defines.

Who can reach it

Local, unprivileged: any code that can open an io_uring instance and issue IORING_OP_CONNECT - a tenant process inside a GPU pod or a container, with no extra authentication. Nodes that do not use io_uring connect filters are not affected.

What to do

Update to a stable kernel carrying the fix (threshold changed to SIN6_LEN_RFC2133) - commits 596a955d2d01 and aa5d5f8e5023 - and reboot the node; the hook lives in built-in kernel code, so there is no module reload or daemon restart that avoids the reboot. Until the node can be drained, treat io_uring connect filtering as non-authoritative and keep the real control at the network layer (namespace or VLAN separation, host firewall rules), or disable io_uring for untrusted workloads where your runtime supports it.

References

Related entries

• Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingCVE-2026-20751 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds read)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingCVE-2026-20879 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds write)High
• wolfSSL: trusted-peer matching ignores the public key, so a forged CA clone verifiesCVE-2026-93302 · wolfSSL MatchTrustedPeer (trusted peer certificate verification)High
• Xen PCI passthrough on Intel VT-d chipsets without interrupt remapping: The founding GPU-passthrough escape. A guestCVE-2011-1898 · Xen PCI passthrough on Intel VT-d chipsets without interrupt remappingHigh
• Xen libxl (xenlight) PCI passthrough device setup: The toolstack hands a bus-mastering-capable PCI device to an HVMCVE-2013-4329 · Xen libxl (xenlight) PCI passthrough device setupHigh
• Xen Intel VT-d IOMMU page-table handling for PCI passthrough: An inverted boolean means Xen clears a present IOMMUCVE-2013-6375 · Xen Intel VT-d IOMMU page-table handling for PCI passthroughHigh