[PATCH net,v2 0/4 RESEND] Netfilter fixes for net
From: Pablo Neira Ayuso <pablo@netfilter.org>
Date: 2026-09-13 20:55:03
Also in:
netfilter-devel
I forgot to Cc: netdev@ in this new PR.
v2: - reword the commit description of the nf_nat_register_fn() to
explicitly refer to the memleak, so LLM does not get confused.
- drop the xt_IDLETIMER and module = THIS_MODULE in netlink_dump.
- keep back IPVS fix as Julian prefer to send a v2.
-o-
Hi,
The following patchset contains Netfilter fixes for net:
1) Fix KMSAN reports an uninit-value in nf_nat_setup_info() for netmap,
from Theodor Arsenij Larionov Trichkine.
2) Restrict deletion of netdevice in basechain and flowtable to exact
matching only, from Fernando F. Mancera.
3) Fix nf_nat_register_fn() error path allowing for a memleak.
4) Hold reference on ct until flow is released to address, otherwise
access to release ct->ext or different ct due to typesafe RCU
semantics.
Please, pull these changes from:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-11
Thanks.
----------------------------------------------------------------
The following changes since commit 78445023439506ebd83b86d40b1e428a3b309d4a:
Merge tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-09-10 14:07:48 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-11
for you to fetch changes up to e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d:
netfilter: flowtable: hold reference on ct until flow is released (2026-09-11 13:04:15 +0200)
----------------------------------------------------------------
netfilter pull request 26-09-11
----------------------------------------------------------------
Fernando Fernandez Mancera (1):
netfilter: nf_tables: fix device name and prefix match in hook lookup
Pablo Neira Ayuso (2):
netfilter: nf_nat: unregister and release hooks on error
netfilter: flowtable: hold reference on ct until flow is released
Theodor Arsenij Larionov Trichkine (1):
netfilter: nft_nat: fully initialise new_addr in netmap setup
net/netfilter/nf_flow_table_core.c | 12 ++++++++--
net/netfilter/nf_nat_core.c | 46 +++++++++++++++++++++++++-------------
net/netfilter/nf_tables_api.c | 22 ++++++++++--------
net/netfilter/nft_nat.c | 2 +-
4 files changed, 54 insertions(+), 28 deletions(-)