CVE-2024-26631

What it actually does

Data race on idev->mc_ifc_count in ipv6_mc_down and mld_ifc_work allows concurrent unsynchronized writes during IPv6 multicast interface teardown and workqueue processing.

Why it matters to the business

Systems running affected Linux kernels may experience instability or crashes when IPv6 multicast interfaces are reconfigured, potentially causing brief network outages; low immediate risk given absence from known exploitation lists and low EPSS.

How an attack unfolds

An attacker with local or network-adjacent access triggers interface flag changes (via rtnl_newlink or similar) while mld_ifc_work is scheduled, racing against ipv6_mc_down to corrupt the count field; no named threat actors or ransomware campaigns have been observed leveraging this race.

How to fix it

Upgrade the Linux kernel to a version containing commit 62b3387beef11738eb6ce667601a28fa089fa02c or later; for AlmaLinux 8 systems also ensure libreoffice-voikko is at 5.0-6.el8 or newer; apply the fix that wraps mld_ifc_stop_work and mld_gq_stop_work with mc_lock mutex.

How to confirm the fix worked

Verify the presence of mutex_lock/unlock around mld_ifc_stop_work calls in net/ipv6/mcast.c; confirm kernel build contains the referenced commit hash; re-run KCSAN or syzkaller workloads that previously reproduced the race.

Typical attack path

1. Trigger IPv6 multicast group operations on an interface
2. Concurrently initiate interface flag or link changes via netlink or device notifier paths
3. Race between mld_ifc_stop_work and mld_ifc_work corrupts mc_ifc_count
4. Resulting kernel memory inconsistency leads to workqueue or notifier chain failure

How to detect it

Review kernel logs for KCSAN reports or BUG entries referencing mcast.c:1080 or mld_ifc_work; inspect workqueue and netlink traces around addrconf_ifdown events; no widespread in-the-wild indicators exist.

What your security team should do

• Patch kernels to the fixed commit on all systems exposing IPv6 multicast
• Prioritize updates on hosts with frequent interface reconfiguration or container networking
• Monitor EPSS and KEV feeds for any future increase in exploit maturity
• Test interface teardown paths in staging before broad rollout