From: Jakub Kicinski Date: Thu, 2 Apr 2026 02:19:35 +0000 (-0700) Subject: Merge tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf X-Git-Tag: v7.0-rc7~28^2~14 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aba53ccf05607d1116839a85415df9c07118bf4c;p=thirdparty%2Flinux.git Merge tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net. Note that most of the bugs fixed here are >5 years old. The large PR is not due to an increase in regressions. 1) Flowtable hardware offload support in IPv6 can lead to out-of-bounds when populating the rule action array when combined with double-tagged vlan. Bump the maximum number of actions from 16 to 24 and check that such limit is never reached, otherwise bail out. This bugs stems from the original flowtable hardware offload support. 2) nfnetlink_log does not include the netlink header size of the trailing NLMSG_DONE message when calculating the skb size. From Florian Westphal. 3) Reject names in xt_cgroup and xt_rateest extensions which are not nul-terminated. Also from Florian. 4) Use nla_strcmp in ipset lookup by set name, since IPSET_ATTR_NAME and IPSET_ATTR_NAMEREF are of NLA_STRING type. From Florian Westphal. 5) When unregistering conntrack helpers, pass the helper that is going away so the expectation cleanup is done accordingly, otherwise UaF is possible when accessing expectation that refer to the helper that is gone. From Qi Tang. 6) Zero expectation NAT fields to address leaking kernel memory through the expectation netlink dump when unset. Also from Qi Tang. 7) Use the master conntrack helper when creating expectations via ctnetlink, ignore the suggested helper through CTA_EXPECT_HELP_NAME. This allows to address a possible read of kernel memory off the expectation object boundary. 8) Fix incorrect release of the hash bucket logic in ipset when the bucket is empty, leading to shrinking the hash bucket to size 0 which deals to out-of-bound write in next element additions. From Yifan Wu. 9) Allow the use of x_tables extensions that explicitly declare NFPROTO_ARP support only. This is to avoid an incorrect hook number validation due to non-overlapping arp and inet hook number definitions. 10) Reject immediate NF_QUEUE verdict in nf_tables. The userspace nft tool always uses the nft_queue expression for queueing. This ensures this verdict cannot be used for the arp family, which does supported this. * tag 'nf-26-04-01' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: reject immediate NF_QUEUE verdict netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP netfilter: ipset: drop logically empty buckets in mtype_del netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent netfilter: nf_conntrack_helper: pass helper to expect cleanup netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr netfilter: x_tables: ensure names are nul-terminated netfilter: nfnetlink_log: account for netlink header size netfilter: flowtable: strictly check for maximum number of actions ==================== Link: https://patch.msgid.link/20260401103646.1015423-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski --- aba53ccf05607d1116839a85415df9c07118bf4c