The Linux kernel’s netfilter nf_tables module previously permitted an immediate NF_QUEUE verdict, a condition that is never used by user‑space nftables tools. The vulnerability arises because such a verdict could be manually constructed or triggered, leading to packets being handled out of the intended queueing workflow, which could in turn cause unexpected packet filtering or loss. The patch explicitly rejects all immediate NF_QUEUE verdicts, restoring the correct queuing logic and preventing any premature packet delivery.

All Linux kernel builds that predate the commit introducing the rejection logic are potentially affected. The CNA vendors list only "Linux:Linux" and no explicit version range is provided, so any kernel not yet updated to include the nf_tables immediate NF_QUEUE verdict fix remains vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploitation data is current. The CVSS score is 5.5, indicating medium severity. Based on the description, it is inferred that a local or elevated process capable of manipulating nftables rules could trigger the flaw. Given the lack of exploitation references and the absence of a high EPSS score, the overall risk appears low to moderate, but it remains prudent to address it promptly.