A logic flaw in the Linux kernel’s netfilter nfnetlink_queue module causes all received packets to be dropped when a GSO packet arrives with an unconfirmed connection entry and the process lacks the F_GSO capability flag. The kernel performs the unconfirmed check after segmentation, resulting in packet loss. Unlike TCP, where only the SYN packet is unconfirmed, this issue affects UDP traffic routed through nfqueue, potentially disrupting legitimate traffic and producing a denial‑of‑service effect.

All current Linux kernel builds prior to the patch release, regardless of distribution, as the vulnerability is in the core nfnetlink_queue component. Administrators should verify that their kernels have been updated to versions including the recent commit that moves the unconfirmed check before segmentation.

The EPSS score is unavailable and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Although no public exploit is documented, the flaw can be triggered by an attacker who sends crafted GSO UDP packets to a target system handling nfqueue traffic, leading to sustained packet drops. The impact is confined to network traffic; no compromise of host integrity or confidentiality is reported. The overall risk is moderate, with the primary concern being service availability.