The vulnerability originates from the Linux kernel’s nexthop module storing ECMP weights in an 8‑bit field. This is a CWE‑190 (Integer Overflow or Wraparound) and CWE‑787 (Out‑of‑Bounds Write) vulnerability. When administrators configure weight values that exceed 255, the field cannot represent the full value, potentially leading to incorrect weight ratios and sub‑optimal packet routing. The patch addressed this by widening the weight field to a 16‑bit type; the change was carefully applied in two stages to avoid numeric errors. Based on the description, it is inferred that systems using the older 8‑bit representation could experience weight truncation during high‑fan‑out ECMP scenarios.

All standard Linux kernel builds prior to the patch that introduced the 16‑bit weight field are affected. The CNA identifies the product as Linux:Linux, indicating any upstream kernel lacking the fix is vulnerable. No specific distribution or vendor is singled out, so any system running an impacted kernel version is at risk.

The CVSS score of 7.8 marks this issue as high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is privileged configuration of ECMP groups; based on the description, it is inferred that a attacker with CAP_NET_ADMIN privileges could supply oversized weight values, causing the kernel to truncate them and skew routing decisions. The impact is limited to routing behaviour; no direct local privilege escalation or remote code execution is disclosed.