How are they affected yet no exploits can impact users?
The hole is there, and publicly known as of today, but nothing a high school script kiddie can trivially leverage for good grades. Yet.
No one is giving out payloads and telling people they can try this at home, and watch it go. Nothing is known to be in a pastebin or git repo at the moment. This doesn’t mean the black market isn’t crafting kits for sale at a high price right now for big game hunting though.
Any company or project providing a patch, has a way of testing the validity of the patch. Those test kits can be weaponized, but not without a degree of skill. Anyone who tests software knows this.