From: Jakub Kicinski Date: Wed, 5 Aug 2026 23:23:02 +0000 (-0700) Subject: Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=9113e98eb7e353a70428c24e4e4765ba8279ce20;p=thirdparty%2Fkernel%2Flinux.git Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Partial pull of the nf-26-07-31 tag Pablo says: ==================== The following patchset contains Netfilter/IPVS fixes net, this includes fixes for ebtables nflog target, ipset hash type, IPVS kthread estimator 1) Prevent IPVS kthread estimator from draining the est_temp_list when netns is being dismantled. From Zhiling Zou. 2) Missing module nflog refcount bump from ebtables nflog target from .checkentry path. Similar dependency exists already in xt_NFLOG and nft_log. From Chengfeng Ye. 3) Use RCU to fix ipset bookkeeping of cidr values on weakly-ordered architectures. From Jozsef Kadlecsik. 4) Use atomic64_t for set->ext_size in ipset to fix parallel inserts and deletes racing on updating it. From Jozsef Kadlecsik. 5) Add small wrappers for hash and bucket size to prepare the update of ipset hash set types to rhashtable, from Florian Westphal. 6) Add mtype_del_cidr_all() and use it to prepare the migration of ipset hash types to rhashtable. From Florian Westphal. 7) Replace existing ipset call_rcu() based destruction with rcu_work api also to ease the transition to rhashtable. Also from Florian. 8) Avoid reading the IPv4 ihl field multiple times to prevent local attacker to cause out-of-bounds write in ip_vs_nat_icmp(), from Julian Anastasov. 9) Restore the checksum validations that could be needed by the IPVS FORWARD hook. Also from Julian. ==================== Link: https://patch.msgid.link/20260731151806.849724-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski --- 9113e98eb7e353a70428c24e4e4765ba8279ce20