Nftables: a new packet filtering engine

Why not LLVM? It's not just a VM, it's a compiler framework. You'll just need to develop a proper frontend which parses the nftables syntax and a backend which generates bytecode for the kernel VM. As a bonus you'll get the LLVM optimizations.