The Linux kernel’s nexthop module stored forwarding weights in an 8‑bit field. When administrators configured weights that exceeded 255, the values were truncated, producing incorrect ECMP weight ratios. This misranking could cause sub‑optimal routing and traffic steering through non‑optimal paths. The flaw manifests as a numeric overflow (CWE‑190) and was mitigated by expanding the internal weight type from u8 to u16 with a cautious two‑step conversion to prevent errors.

All Linux kernel releases that have not yet incorporated the patch committing the 16‑bit weight field are affected. This includes mainstream distributions such as Debian, Ubuntu, Red Hat Enterprise Linux, CentOS, Fedora, openSUSE, and any other kernel that has not yet upstreamed the change referenced in the CVE description.

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1 % shows that exploitation is considered rare. The vulnerability is not listed in CISA's KEV catalog. Because configuration of nexthop groups requires CAP_NET_ADMIN privileges, the likely attack vector is local privileged; a regular user cannot trigger the overflow directly. The extensive ECMP weight configuration space creates a potential exploit surface that could be abused by an attacker with local system access to compromise routing reliability.