Numeric Truncation Error in Linux kernel - CVE-2024-14040
Published: July 27, 2026
Vulnerability identifier: #VU139402
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-14040
CWE-ID: CWE-197
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause incorrect nexthop group behavior.
The vulnerability exists due to an integer truncation issue in the nexthop group weight handling in the Linux kernel when processing nexthop group configuration. A local user can supply specially crafted weight values to cause incorrect nexthop group behavior.
The issue arises in environments using large ECMP weight ratios that exceed 8-bit weight representation.
Affected software
Linux kernel
How to mitigate CVE-2024-14040
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3