CVE-2024-14040: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-14040 is a Linux kernel vulnerability in the nexthop subsystem related to the expansion of the ECMP weight field from an 8-bit (u8) to a 16-bit (u16) type. The change was introduced to support CLOS network deployments where high fan-out and large node counts require weight ratios (e.g., 1000:999) that exceed the 8-bit range. The vulnerability was published on July 26, 2026, and affects Linux kernel versions prior to commit b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd, with kernel 6.12 and later considered unaffected. The CVSS severity is estimated as Medium by Feedly; no official CVSS score has been assigned at this time (GitHub Advisory).

The root cause is a type-safety concern introduced when expanding the nexthop_grp structure's weight field from u8 to u16 in the Linux kernel's nexthop group UAPI (NHA_GROUP attribute). The resvd1 field in struct nexthop_grp is repurposed as weight_high to carry the high-order bits of the weight, while the original weight field retains the low-order bits. This split-field approach was chosen to maintain backward compatibility and avoid endianness issues, but improper handling of the type conversion could introduce numerical errors or memory corruption in affected kernel versions. No CWE classification has been formally assigned (GitHub Advisory).

Exploitation of this vulnerability could result in kernel instability or memory corruption in Linux systems deployed in CLOS network environments where ECMP weight adjustments are performed. The potential impact is limited to systems actively configuring nexthop group weights beyond 8-bit values, and the risk is primarily to availability and integrity of the networking subsystem rather than confidentiality. Lateral movement or data exfiltration are not directly associated with this vulnerability (GitHub Advisory).

The fix is available in the upstream Linux kernel at commit b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd. Kernel version 6.12 and later are unaffected. Administrators should update to a patched kernel version that includes this commit. No configuration-based workarounds have been documented; upgrading the kernel is the recommended remediation (GitHub Advisory).