CVE-2024-14040 (GCVE-0-2024-14040)

Vulnerability from cvelistv5 – Published: 2026-07-26 06:30 – Updated: 2026-10-30 12:17
VLAI
Title
net: nexthop: Increase weight to u16
Summary
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall high number of nodes, a (non-)ECMP weight ratio that we would like to configure does not fit into 8 bits. Instead of, say, 255:254, we might like to configure something like 1000:999. For these deployments, the 8-bit weight may not be enough. To that end, in this patch increase the next hop weight from u8 to u16. Increasing the width of an integral type can be tricky, because while the code still compiles, the types may not check out anymore, and numerical errors come up. To prevent this, the conversion was done in two steps. First the type was changed from u8 to a single-member structure, which invalidated all uses of the field. This allowed going through them one by one and audit for type correctness. Then the structure was replaced with a vanilla u16 again. This should ensure that no place was missed. The UAPI for configuring nexthop group members is that an attribute NHA_GROUP carries an array of struct nexthop_grp entries: struct nexthop_grp { __u32 id; /* nexthop id - must exist */ __u8 weight; /* weight of this nexthop */ __u8 resvd1; __u16 resvd2; }; The field resvd1 is currently validated and required to be zero. We can lift this requirement and carry high-order bits of the weight in the reserved field: struct nexthop_grp { __u32 id; /* nexthop id - must exist */ __u8 weight; /* weight of this nexthop */ __u8 weight_high; __u16 resvd2; }; Keeping the fields split this way was chosen in case an existing userspace makes assumptions about the width of the weight field, and to sidestep any endianness issues. The weight field is currently encoded as the weight value minus one, because weight of 0 is invalid. This same trick is impossible for the new weight_high field, because zero must mean actual zero. With this in place: - Old userspace is guaranteed to carry weight_high of 0, therefore configuring 8-bit weights as appropriate. When dumping nexthops with 16-bit weight, it would only show the lower 8 bits. But configuring such nexthops implies existence of userspace aware of the extension in the first place. - New userspace talking to an old kernel will work as long as it only attempts to configure 8-bit weights, where the high-order bits are zero. Old kernel will bounce attempts at configuring >8-bit weights. Renaming reserved fields as they are allocated for some purpose is commonly done in Linux. Whoever touches a reserved field is doing so at their own risk. nexthop_grp::resvd1 in particular is currently used by at least strace, however they carry an own copy of UAPI headers, and the conversion should be trivial. A helper is provided for decoding the weight out of the two fields. Forcing a conversion seems preferable to bending backwards and introducing anonymous unions or whatever.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 21:40 UTC
CWE
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6639 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 283a72a5599e80750699d2021830a294ed9ab3f3 , < f9d682935afe102d6b7060914304c04483d6cbd6 (git)
Affected: 283a72a5599e80750699d2021830a294ed9ab3f3 , < 2860d59e4ce2bb428c8cecd3b95585012910b7d0 (git)
Affected: 283a72a5599e80750699d2021830a294ed9ab3f3 , < b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-14040",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:40:23.769784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:05:06.269Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/nexthop.h",
            "include/uapi/linux/nexthop.h",
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f9d682935afe102d6b7060914304c04483d6cbd6",
              "status": "affected",
              "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
              "versionType": "git"
            },
            {
              "lessThan": "2860d59e4ce2bb428c8cecd3b95585012910b7d0",
              "status": "affected",
              "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
              "versionType": "git"
            },
            {
              "lessThan": "b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd",
              "status": "affected",
              "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/nexthop.h",
            "include/uapi/linux/nexthop.h",
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Increase weight to u16\n\nIn CLOS networks, as link failures occur at various points in the network,\nECMP weights of the involved nodes are adjusted to compensate. With high\nfan-out of the involved nodes, and overall high number of nodes,\na (non-)ECMP weight ratio that we would like to configure does not fit into\n8 bits. Instead of, say, 255:254, we might like to configure something like\n1000:999. For these deployments, the 8-bit weight may not be enough.\n\nTo that end, in this patch increase the next hop weight from u8 to u16.\n\nIncreasing the width of an integral type can be tricky, because while the\ncode still compiles, the types may not check out anymore, and numerical\nerrors come up. To prevent this, the conversion was done in two steps.\nFirst the type was changed from u8 to a single-member structure, which\ninvalidated all uses of the field. This allowed going through them one by\none and audit for type correctness. Then the structure was replaced with a\nvanilla u16 again. This should ensure that no place was missed.\n\nThe UAPI for configuring nexthop group members is that an attribute\nNHA_GROUP carries an array of struct nexthop_grp entries:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tresvd1;\n\t\t__u16\tresvd2;\n\t};\n\nThe field resvd1 is currently validated and required to be zero. We can\nlift this requirement and carry high-order bits of the weight in the\nreserved field:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tweight_high;\n\t\t__u16\tresvd2;\n\t};\n\nKeeping the fields split this way was chosen in case an existing userspace\nmakes assumptions about the width of the weight field, and to sidestep any\nendianness issues.\n\nThe weight field is currently encoded as the weight value minus one,\nbecause weight of 0 is invalid. This same trick is impossible for the new\nweight_high field, because zero must mean actual zero. With this in place:\n\n- Old userspace is guaranteed to carry weight_high of 0, therefore\n  configuring 8-bit weights as appropriate. When dumping nexthops with\n  16-bit weight, it would only show the lower 8 bits. But configuring such\n  nexthops implies existence of userspace aware of the extension in the\n  first place.\n\n- New userspace talking to an old kernel will work as long as it only\n  attempts to configure 8-bit weights, where the high-order bits are zero.\n  Old kernel will bounce attempts at configuring \u003e8-bit weights.\n\nRenaming reserved fields as they are allocated for some purpose is commonly\ndone in Linux. Whoever touches a reserved field is doing so at their own\nrisk. nexthop_grp::resvd1 in particular is currently used by at least\nstrace, however they carry an own copy of UAPI headers, and the conversion\nshould be trivial. A helper is provided for decoding the weight out of the\ntwo fields. Forcing a conversion seems preferable to bending backwards and\nintroducing anonymous unions or whatever."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable arithmetic is reached through a locally issued RTM_NEWNEXTHOP rtnetlink request, followed by routing traffic through the corrupted resilient group.\nAC:L - The attacker deterministically controls the bucket count, member weights, replacement ordering, and triggering flows; no race or uncontrollable condition is required.\nPR:L - RTM_NEWNEXTHOP requires CAP_NET_ADMIN in the network namespace, which an unprivileged user can obtain in a newly created user and network namespace.\nUI:N - No victim action is required after the attacker creates and exercises the malformed resilient nexthop group.\nS:U - Exploitation compromises the host kernel within its existing security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The overflow can leave a stale nh_grp_entry referencing freed group and per-CPU statistics memory, creating an attacker-groomable use-after-free capable of exposing kernel memory.\nI:H - Forwarding through the stale bucket writes through the freed per-CPU statistics pointer, providing a memory-corruption primitive potentially usable for arbitrary writes or code execution.\nA:H - The corrupted bucket can cause an immediate NULL-pointer dereference or use-after-free during route selection, resulting in a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:17:41.141Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f9d682935afe102d6b7060914304c04483d6cbd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2860d59e4ce2bb428c8cecd3b95585012910b7d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd"
        }
      ],
      "title": "net: nexthop: Increase weight to u16",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-14040",
    "datePublished": "2026-07-26T06:30:17.607Z",
    "dateReserved": "2026-07-26T06:29:25.532Z",
    "dateUpdated": "2026-10-30T12:17:41.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-14040",
      "date": "2026-11-09",
      "epss": "0.00173",
      "percentile": "0.06808"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-07T01:49:32.000Z",
      "cve": "CVE-2024-14040",
      "id": "msrc_CVE-2024-14040",
      "initial_release_date": "2026-07-27T01:04:21.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: nexthop: Increase weight to u16",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2024-14040.json",
      "version": "10"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/nexthop.h",
                  "include/uapi/linux/nexthop.h",
                  "net/ipv4/nexthop.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f9d682935afe102d6b7060914304c04483d6cbd6",
                    "status": "affected",
                    "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2860d59e4ce2bb428c8cecd3b95585012910b7d0",
                    "status": "affected",
                    "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd",
                    "status": "affected",
                    "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/nexthop.h",
                  "include/uapi/linux/nexthop.h",
                  "net/ipv4/nexthop.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Increase weight to u16\n\nIn CLOS networks, as link failures occur at various points in the network,\nECMP weights of the involved nodes are adjusted to compensate. With high\nfan-out of the involved nodes, and overall high number of nodes,\na (non-)ECMP weight ratio that we would like to configure does not fit into\n8 bits. Instead of, say, 255:254, we might like to configure something like\n1000:999. For these deployments, the 8-bit weight may not be enough.\n\nTo that end, in this patch increase the next hop weight from u8 to u16.\n\nIncreasing the width of an integral type can be tricky, because while the\ncode still compiles, the types may not check out anymore, and numerical\nerrors come up. To prevent this, the conversion was done in two steps.\nFirst the type was changed from u8 to a single-member structure, which\ninvalidated all uses of the field. This allowed going through them one by\none and audit for type correctness. Then the structure was replaced with a\nvanilla u16 again. This should ensure that no place was missed.\n\nThe UAPI for configuring nexthop group members is that an attribute\nNHA_GROUP carries an array of struct nexthop_grp entries:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tresvd1;\n\t\t__u16\tresvd2;\n\t};\n\nThe field resvd1 is currently validated and required to be zero. We can\nlift this requirement and carry high-order bits of the weight in the\nreserved field:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tweight_high;\n\t\t__u16\tresvd2;\n\t};\n\nKeeping the fields split this way was chosen in case an existing userspace\nmakes assumptions about the width of the weight field, and to sidestep any\nendianness issues.\n\nThe weight field is currently encoded as the weight value minus one,\nbecause weight of 0 is invalid. This same trick is impossible for the new\nweight_high field, because zero must mean actual zero. With this in place:\n\n- Old userspace is guaranteed to carry weight_high of 0, therefore\n  configuring 8-bit weights as appropriate. When dumping nexthops with\n  16-bit weight, it would only show the lower 8 bits. But configuring such\n  nexthops implies existence of userspace aware of the extension in the\n  first place.\n\n- New userspace talking to an old kernel will work as long as it only\n  attempts to configure 8-bit weights, where the high-order bits are zero.\n  Old kernel will bounce attempts at configuring \u003e8-bit weights.\n\nRenaming reserved fields as they are allocated for some purpose is commonly\ndone in Linux. Whoever touches a reserved field is doing so at their own\nrisk. nexthop_grp::resvd1 in particular is currently used by at least\nstrace, however they carry an own copy of UAPI headers, and the conversion\nshould be trivial. A helper is provided for decoding the weight out of the\ntwo fields. Forcing a conversion seems preferable to bending backwards and\nintroducing anonymous unions or whatever."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: nexthop: Aumentar el peso a u16\n\nEn las redes CLOS, a medida que ocurren fallos de enlace en varios puntos de la red, los pesos ECMP de los nodos involucrados se ajustan para compensar. Con una alta ramificaci\u00f3n de los nodos involucrados y un n\u00famero total elevado de nodos, una relaci\u00f3n de peso (no-)ECMP que nos gustar\u00eda configurar no cabe en 8 bits. En lugar de, digamos, 255:254, podr\u00edamos querer configurar algo como 1000:999. Para estas implementaciones, el peso de 8 bits podr\u00eda no ser suficiente.\n\nCon ese fin, en este parche se aumenta el peso del siguiente salto de u8 a u16.\n\nAumentar el ancho de un tipo integral puede ser complicado, porque si bien el c\u00f3digo a\u00fan compila, los tipos podr\u00edan ya no coincidir y surgen errores num\u00e9ricos. Para evitar esto, la conversi\u00f3n se realiz\u00f3 en dos pasos. Primero, el tipo se cambi\u00f3 de u8 a una estructura de un solo miembro, lo que invalid\u00f3 todos los usos del campo. Esto permiti\u00f3 revisarlos uno por uno y auditar la correcci\u00f3n del tipo. Luego, la estructura fue reemplazada por un u16 est\u00e1ndar nuevamente. Esto deber\u00eda asegurar que no se omiti\u00f3 ning\u00fan lugar.\n\nLa UAPI para configurar los miembros del grupo nexthop es que un atributo NHA_GROUP lleva un array de entradas de struct nexthop_grp:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* id de nexthop - debe existir */\n\t\t__u8\tweight;   /* peso de este nexthop */\n\t\t__u8\tresvd1;\n\t\t__u16\tresvd2;\n\t};\n\nEl campo resvd1 est\u00e1 actualmente validado y se requiere que sea cero. Podemos levantar este requisito y llevar los bits de orden superior del peso en el campo reservado:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* id de nexthop - debe existir */\n\t\t__u8\tweight;   /* peso de este nexthop */\n\t\t__u8\tweight_high;\n\t\t__u16\tresvd2;\n\t};\n\nSe eligi\u00f3 mantener los campos divididos de esta manera en caso de que un userspace existente haga suposiciones sobre el ancho del campo de peso, y para evitar cualquier problema de endianness.\n\nEl campo de peso est\u00e1 actualmente codificado como el valor del peso menos uno, porque un peso de 0 es inv\u00e1lido. Este mismo truco es imposible para el nuevo campo weight_high, porque cero debe significar cero real. Con esto implementado:\n\n- Se garantiza que el userspace antiguo llevar\u00e1 un weight_high de 0, por lo tanto, configurando pesos de 8 bits seg\u00fan corresponda. Al volcar nexthops con peso de 16 bits, solo mostrar\u00eda los 8 bits inferiores. Pero configurar tales nexthops implica la existencia de un userspace consciente de la extensi\u00f3n en primer lugar.\n\n- El nuevo userspace que se comunica con un kernel antiguo funcionar\u00e1 siempre y cuando solo intente configurar pesos de 8 bits, donde los bits de orden superior son cero. El kernel antiguo rechazar\u00e1 los intentos de configurar pesos \u003e8 bits.\n\nRenombrar campos reservados a medida que se asignan para alg\u00fan prop\u00f3sito es algo com\u00fan en Linux. Quien toque un campo reservado lo hace bajo su propio riesgo. nexthop_grp::resvd1 en particular es actualmente utilizado por al menos strace, sin embargo, llevan una copia propia de los encabezados UAPI, y la conversi\u00f3n deber\u00eda ser trivial. Se proporciona una funci\u00f3n de ayuda para decodificar el peso de los dos campos. Forzar una conversi\u00f3n parece preferible a hacer malabares e introducir uniones an\u00f3nimas o lo que sea."
          }
        ],
        "id": "CVE-2024-14040",
        "lastModified": "2026-11-03T18:15:39.353",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-14040",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T21:40:23.769784Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-26T07:16:39.583",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2860d59e4ce2bb428c8cecd3b95585012910b7d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f9d682935afe102d6b7060914304c04483d6cbd6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-05T11:45:16+00:00",
      "cve": "CVE-2024-14040",
      "id": "CVE-2024-14040",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "109",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: nexthop: Increase weight to u16",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-14040.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-14040",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T21:40:23.769784Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-787",
                    "description": "CWE-787 Out-of-bounds Write",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-15T21:40:24.470Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "include/net/nexthop.h",
                "include/uapi/linux/nexthop.h",
                "net/ipv4/nexthop.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "f9d682935afe102d6b7060914304c04483d6cbd6",
                  "status": "affected",
                  "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                  "versionType": "git"
                },
                {
                  "lessThan": "2860d59e4ce2bb428c8cecd3b95585012910b7d0",
                  "status": "affected",
                  "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                  "versionType": "git"
                },
                {
                  "lessThan": "b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd",
                  "status": "affected",
                  "version": "283a72a5599e80750699d2021830a294ed9ab3f3",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "include/net/nexthop.h",
                "include/uapi/linux/nexthop.h",
                "net/ipv4/nexthop.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.13"
                },
                {
                  "lessThan": "5.13",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.191",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.160",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.191",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.160",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "5.13",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: Increase weight to u16\n\nIn CLOS networks, as link failures occur at various points in the network,\nECMP weights of the involved nodes are adjusted to compensate. With high\nfan-out of the involved nodes, and overall high number of nodes,\na (non-)ECMP weight ratio that we would like to configure does not fit into\n8 bits. Instead of, say, 255:254, we might like to configure something like\n1000:999. For these deployments, the 8-bit weight may not be enough.\n\nTo that end, in this patch increase the next hop weight from u8 to u16.\n\nIncreasing the width of an integral type can be tricky, because while the\ncode still compiles, the types may not check out anymore, and numerical\nerrors come up. To prevent this, the conversion was done in two steps.\nFirst the type was changed from u8 to a single-member structure, which\ninvalidated all uses of the field. This allowed going through them one by\none and audit for type correctness. Then the structure was replaced with a\nvanilla u16 again. This should ensure that no place was missed.\n\nThe UAPI for configuring nexthop group members is that an attribute\nNHA_GROUP carries an array of struct nexthop_grp entries:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tresvd1;\n\t\t__u16\tresvd2;\n\t};\n\nThe field resvd1 is currently validated and required to be zero. We can\nlift this requirement and carry high-order bits of the weight in the\nreserved field:\n\n\tstruct nexthop_grp {\n\t\t__u32\tid;\t  /* nexthop id - must exist */\n\t\t__u8\tweight;   /* weight of this nexthop */\n\t\t__u8\tweight_high;\n\t\t__u16\tresvd2;\n\t};\n\nKeeping the fields split this way was chosen in case an existing userspace\nmakes assumptions about the width of the weight field, and to sidestep any\nendianness issues.\n\nThe weight field is currently encoded as the weight value minus one,\nbecause weight of 0 is invalid. This same trick is impossible for the new\nweight_high field, because zero must mean actual zero. With this in place:\n\n- Old userspace is guaranteed to carry weight_high of 0, therefore\n  configuring 8-bit weights as appropriate. When dumping nexthops with\n  16-bit weight, it would only show the lower 8 bits. But configuring such\n  nexthops implies existence of userspace aware of the extension in the\n  first place.\n\n- New userspace talking to an old kernel will work as long as it only\n  attempts to configure 8-bit weights, where the high-order bits are zero.\n  Old kernel will bounce attempts at configuring \u003e8-bit weights.\n\nRenaming reserved fields as they are allocated for some purpose is commonly\ndone in Linux. Whoever touches a reserved field is doing so at their own\nrisk. nexthop_grp::resvd1 in particular is currently used by at least\nstrace, however they carry an own copy of UAPI headers, and the conversion\nshould be trivial. A helper is provided for decoding the weight out of the\ntwo fields. Forcing a conversion seems preferable to bending backwards and\nintroducing anonymous unions or whatever."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable arithmetic is reached through a locally issued RTM_NEWNEXTHOP rtnetlink request, followed by routing traffic through the corrupted resilient group.\nAC:L - The attacker deterministically controls the bucket count, member weights, replacement ordering, and triggering flows; no race or uncontrollable condition is required.\nPR:L - RTM_NEWNEXTHOP requires CAP_NET_ADMIN in the network namespace, which an unprivileged user can obtain in a newly created user and network namespace.\nUI:N - No victim action is required after the attacker creates and exercises the malformed resilient nexthop group.\nS:U - Exploitation compromises the host kernel within its existing security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The overflow can leave a stale nh_grp_entry referencing freed group and per-CPU statistics memory, creating an attacker-groomable use-after-free capable of exposing kernel memory.\nI:H - Forwarding through the stale bucket writes through the freed per-CPU statistics pointer, providing a memory-corruption primitive potentially usable for arbitrary writes or code execution.\nA:H - The corrupted bucket can cause an immediate NULL-pointer dereference or use-after-free during route selection, resulting in a kernel oops or panic."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-30T12:17:41.141Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/f9d682935afe102d6b7060914304c04483d6cbd6"
            },
            {
              "url": "https://git.kernel.org/stable/c/2860d59e4ce2bb428c8cecd3b95585012910b7d0"
            },
            {
              "url": "https://git.kernel.org/stable/c/b72a6a7ab9573e06d5c2fcb92eaa28614a735bfd"
            }
          ],
          "title": "net: nexthop: Increase weight to u16",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-14040",
        "datePublished": "2026-07-26T06:30:17.607Z",
        "dateReserved": "2026-07-26T06:29:25.532Z",
        "dateUpdated": "2026-10-30T12:17:41.141Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.