During the handling of GSO packets by the Linux kernel's netfilter nfnetlink_queue module, the check for unconfirmed connection entries mistakenly occurs after packet segmentation. If an application lacks the F_GSO capability flag and receives a GSO UDP packet with an unconfirmed nf_conn entry, all segments are dropped rather than queued. This logic flaw results in a denial‑of‑service condition for UDP traffic routed through nfqueue, with no impact on system integrity or confidentiality.

All Linux kernel releases that include the nfnetlink_queue module before the commit that moves the unconfirmed check to precede segmentation. The affected products are part of the core Linux kernel across vendors such as Ubuntu, Red Hat, Debian, and others, as represented by the common CPE for the Linux kernel. The patch is included in kernel versions built after the commit referenced in the advisory.

The CVSS score of 7.5 indicates moderate severity, and the EPSS score is less than 1 per cent, signalling a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector revolves around sending GSO UDP packets to a target that processes packets via nfqueue; this is inferred from the described interaction between GSO handling and connection tracking. However, the description does not explicitly provide an exploit chain or public exploit, so practical exploitation remains uncertain.