CVE-2024-14040

A flaw was found in the Linux kernel's nexthop networking component. The system uses a weight field to manage network traffic distribution, particularly in complex network environments known as CLOS networks. This field was limited to an 8-bit value, which is insufficient for modern, high-scale network configurations. A local attacker could potentially exploit this limitation, leading to incorrect network traffic handling, which may result in a denial of service (making network services unavailable) or the disclosure of sensitive network information.

This Moderate impact vulnerability in the Linux kernel addresses a potential for numerical errors when configuring Equal-Cost Multi-Path (ECMP) weights in CLOS networks. The issue arises from an insufficient 8-bit weight field, which could lead to incorrect weight ratios in deployments with high fan-out. Exploitation requires specific userspace configurations attempting to utilize weights exceeding 8 bits.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.