CVE-2024-26679

What it actually does

Data race on sk->sk_family read in inet_recv_error() without socket lock, allowing mutation from IPv6 to IPv4 via IPV6_ADDRFORM and triggering KCSAN warning.

Why it matters to the business

Kernel instability warnings on affected Xen hypervisor deployments may complicate debugging and maintenance, increasing operational overhead for organizations relying on Alpine Linux packages.

How an attack unfolds

An attacker with local access triggers concurrent socket option changes on IPv6 sockets while inet_recv_error runs unlocked, exposing the race condition that surfaces as a KCSAN warning in the Linux kernel used by Xen.

How to fix it

Upgrade the xen package on Alpine v3.10 to version 4.12.3-r4 or later; apply the upstream kernel commit that reads sk->sk_family only once under proper locking.

How to confirm the fix worked

Confirm package version is 4.12.3-r4 or newer via package manager; rebuild kernel with KCSAN enabled and re-test socket mutation scenarios to verify absence of the warning.

Typical attack path

1. Obtain local access to a system running the vulnerable Xen package on Alpine Linux
2. Create an IPv6 socket and concurrently invoke IPV6_ADDRFORM to mutate it to IPv4
3. Trigger inet_recv_error paths without holding the socket lock to hit the data race
4. Observe KCSAN warning or related kernel diagnostic output

How to detect it

Search kernel logs and KCSAN reports for warnings mentioning inet_recv_error and sk_family; correlate with processes performing IPV6_ADDRFORM socket operations.

What your security team should do

• Prioritize upgrade of xen on Alpine v3.10 to 4.12.3-r4 across all affected hosts
• Monitor kernel logs for KCSAN warnings related to inet_recv_error after patching
• Review socket option usage in any local applications that manipulate IPv6 sockets