In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall high number of nodes, a (non-)ECMP weight ratio that we would like to configure does not fit into 8 bits. Instead of, say, 255:254, we might like to configure something like 1000:999. For these deployments, the 8-bit weight may not be enough. To that end, in this patch increase the next hop weight from u8 to u16. Increasing the width of an integral type can be tricky, because while the code still compiles, the types may not check out anymore, and numerical errors come up. To prevent this, the conversion was done in two steps. First the type was changed from u8 to a single-member structure, which invalidated all uses of the field. This allowed going through them one by one and audit for type
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2024-14040 addresses a constraint in the Linux kernel's nexthop routing implementation where ECMP (Equal-Cost Multipath) weights were limited to 8-bit values (0-255). In modern CLOS network architectures used by hyperscalers and large enterprises, link failures trigger dynamic weight adjustments across high fan-out topologies with hundreds or thousands of nodes. The 8-bit limitation prevents operators from configuring fine-grained weight ratios needed for optimal traffic distribution—forcing crude ratios like 255:254 instead of desired precision like 1000:999. This vulnerability affects Linux systems running as network devices, routers, and cloud infrastructure, potentially causing suboptimal traffic engineering, congestion, and reduced network resilience during failure scenarios.
While this CVE has zero mapped MITRE ATT&CK techniques and no associated Casky security skills, it represents a critical infrastructure misconfiguration risk. Detection would occur through infrastructure monitoring rather than behavioral threat analysis: practitioners would identify this vulnerability by auditing kernel versions on routing infrastructure, analyzing nexthop configuration logs for weight value constraints, and correlating network performance degradation during failure scenarios with insufficient weight precision. Organizations using Linux-based network devices in large-scale deployments should prioritize kernel updates to u16 (16-bit) weight support, validate their ECMP configurations post-patch, and implement automated checks to ensure routing weight ratios achieve intended traffic distribution objectives during convergence events.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2024-14040. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation