The vulnerability occurs in the io_connect_bpf_populate function of the Linux kernel where IPv6 connect requests with a 24‑byte sockaddr_in6 structure are processed incorrectly. The code only populates the port and address fields when the length is at least 28 bytes, which is the full structure size. For a 24‑byte address the filter sees a destination with zeroed port and address, while the kernel still attempts to connect to the real target. As a result, a BPF CONNECT filter that denies traffic to specific ports or addresses can be bypassed, allowing connections to otherwise blocked destinations.

The flaw is present in Linux kernel releases 7.2 through 7.3‑rc6, inclusive. Any distribution shipping one of these kernel versions is affected. This is inferred from the description, which lists the 7.3‑rc6 and 7.2 releases as having the same code. Distributions that compile the kernel with the buggy function are at risk regardless of other components.

A local attacker can trigger the bypass by issuing a connect system call with an IPv6 sockaddr_in6 of length 24. The CVSS score of 8.4 denotes a high severity impact, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not present in CISA’s KEV catalog. The primary risk is policy circumvention rather than full system compromise, enabling unauthorized outbound IPv6 traffic in environments that rely on BPF CONNECT filters.