For example I have a program that looks something like this:
int data = 0xfff
setsockopt(sockfd, SOL_SOCKET, SO_KEEPALIVE, &data, sizeof(data))
In the Linux kernel-space where is the data actually located in the sock struct? I tried reading through sock.h, but haven't found anything where the &data variable would be kept.
You can find this out by looking at how the setsockopt syscall is implemented. The sock_valbool_flag() function is used to set a bit in the bitmap sk->sk_flags. The bit used for SO_KEEPALIVE is SOCK_KEEPOPEN.
Given the above, you can check whether a socket (struct sock *sk) is keepalive or not through sock_flag(sk, SOCK_KEEPOPEN), which returns the value of the bit. This is also how the getsockopt syscall does it.
Note: this is for kernel version 5.10, it might differ for your specific version, you should check for yourself.