CVE-2024-26862

What it actually does

Data race on the ignore_outgoing flag in AF_PACKET sockets due to lockless reads in dev_queue_xmit_nit and packet_getsockopt without READ_ONCE/WRITE_ONCE annotations, allowing concurrent modification from packet_setsockopt and packet transmission paths that can result in inconsistent flag values and kernel concurrency issues.

Why it matters to the business

Potential kernel instability, crashes, or hangs under concurrent network workloads on affected Linux systems, increasing operational risk and requiring urgent patching in environments with high packet processing or batman-adv usage; low exploitability reduces immediate threat but does not eliminate stability concerns.

How an attack unfolds

An attacker with local access triggers concurrent calls to packet_setsockopt while network transmission paths like dev_queue_xmit_nit execute, exploiting the unprotected access to the ignore_outgoing flag; this can lead to inconsistent state during batman-adv OGM packet sends or similar operations, surfacing as KCSAN-detected races that may cause denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 84c510411e321caff3c07e6cd0f917f06633cfc0 which adds the required READ_ONCE/WRITE_ONCE annotations; apply the fix across all stable branches and rebuild custom kernels as needed.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; recompile with KCSAN enabled and verify absence of the reported data-race in dev_queue_xmit_nit and packet_setsockopt; test concurrent socket and transmission workloads for stability.

Typical attack path

1. Obtain local user privileges on a vulnerable Linux kernel
2. Open AF_PACKET socket and issue setsockopt to modify ignore_outgoing
3. Trigger concurrent network transmission via batman-adv or dev_queue_xmit paths
4. Observe or induce data race leading to kernel instability or crash

How to detect it

Review kernel logs for KCSAN data-race warnings involving dev_queue_xmit_nit or packet_setsockopt; inspect for crashes during high-concurrency packet transmission; no widespread in-the-wild indicators expected given low EPSS and non-KEV status.

What your security team should do

• Prioritize kernel upgrades to the fixed commit in production environments with networking workloads
• Monitor for KCSAN reports or unexplained kernel panics related to packet handling
• Restrict unprivileged local access where feasible until patched