← All active subsystems in netdev

netfilter · Maintained

Maintainers

• M Pablo Neira Ayuso <pablo@netfilter.org>
• M Florian Westphal <fw@strlen.de>
• R Phil Sutter <phil@nwl.cc>

Paths

• F include/linux/netfilter*
• F include/linux/netfilter/
• F include/net/netfilter/
• F include/uapi/linux/netfilter*
• F include/uapi/linux/netfilter/
• F net/*/netfilter.c
• F net/*/netfilter/
• F net/bridge/br_netfilter*.c
• F net/netfilter/
• F tools/testing/selftests/net/netfilter/

Last 30 days

Most active threads (last 7 days)

• HOTtoday [PATCH nf] netfilter: nf_tables: fix flow rule leak in nft_delrule() error path
  2026-10-28 06:22 · 0 replies in 7d · Xingyuan Mo <hidden>
• WARM2d [PATCH nf] netfilter: ipset: fix double free on kernel-side delete during resize
  2026-10-26 10:30 · 2 replies in 7d · Xue Boyang <hidden>
• WARM1d REVIEWED: 1 (0M) [PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match
  2026-10-26 12:53 · 0 replies in 7d · Fang Xieyan <hidden>
• WARM2d [REGRESSION] netfilter: flowtable: HW offloaded flows are not removed from hardware on flowtable deletion since 13210fc63f35
  2026-10-26 03:57 · 1 reply in 7d · Jalen <hidden>
• WARM2d [PATCH nf] netfilter: nft_set_pipapo: skip transaction elements during GC
  2026-10-24 22:04 · 0 replies in 7d · Joas Antonio dos Santos <hidden>
• WARM1d [PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()
  2026-10-24 17:03 · 0 replies in 7d · Joas Antonio dos Santos <hidden>
• DORMANTno replies [PATCH] netfilter: nf_conntrack_h323: fix out-of-bounds read in get_bitmap()
  2026-10-22 17:49 · 0 replies in 7d · Duc Anh Luu <hidden>
• WARM1d [PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport()
  2026-10-22 17:22 · 0 replies in 7d · Duc Anh Luu <hidden>
• HOTtoday REVIEWED: 1 (0M) [PATCH nf] netfilter: nf_nat: do not link a conntrack twice into nat_bysource
  2026-10-22 11:02 · 0 replies in 7d · Vimal Agrawal <hidden>

Active reviewers (last 30 days)

• Vega <hidden>
  8 attestations (8 Reported-by) · last on 2026-10-18
• Florian Westphal <fw@strlen.de>
  6 attestations (3 Reviewed-by, 3 Suggested-by) · last on 2026-10-19
• Pablo Neira Ayuso <pablo@netfilter.org>
  4 attestations (2 Co-developed-by, 2 Suggested-by) · last on 2026-10-19
• Weibin Liu <hidden>
  3 attestations (3 Reviewed-by) · last on 2026-10-26
• Julian Anastasov <ja@ssi.bg>
  3 attestations (2 Acked-by, 1 Suggested-by) · last on 2026-10-19
• Fernando Fernandez Mancera <hidden>
  2 attestations (2 Reviewed-by) · last on 2026-10-18
• <hidden>
  2 attestations (2 Reported-by) · last on 2026-10-05
• <hidden>
  2 attestations (2 Reported-by) · last on 2026-10-05
• Chuck Lever <cel@kernel.org>
  2 attestations (2 Acked-by) · last on 2026-09-30
• Jalen <hidden>
  1 attestation (1 Reported-by) · last on 2026-10-26

Recent patches

Most-recent 30 patches in this subsystem on netdev (capped at 30), ordered by date desc.

• HOTtoday [PATCH nf] netfilter: nf_tables: fix flow rule leak in nft_delrule() error path
  2026-10-28 · Xingyuan Mo <hidden>
• WARM1d REVIEWED: 1 (0M) [PATCH] netfilter: xt_policy: add NULL check for skb_dst() in output policy match
  2026-10-26 · Fang Xieyan <hidden>
• DORMANTno replies [PATCH nf v3] netfilter: ipset: fix double free on kernel-side delete during resize
  2026-10-26 · Xue Boyang <hidden>
• DORMANTno replies [PATCH nf] netfilter: flowtable: remove hardware flows before unbinding
  2026-10-26 · Paul-Louis Charrière <hidden>
• WARM2d [PATCH nf v2] netfilter: ipset: fix double free on kernel-side delete during resize
  2026-10-25 · Xue Boyang <hidden>
• WARM2d [PATCH nf] netfilter: nft_set_pipapo: skip transaction elements during GC
  2026-10-24 · Joas Antonio dos Santos <hidden>
• WARM1d [PATCH nf v2] netfilter: nf_conntrack_sip: fix OOB read in ct_sip_parse_transport()
  2026-10-24 · Joas Antonio dos Santos <hidden>
• DORMANTno replies [PATCH] netfilter: nf_conntrack_h323: fix out-of-bounds read in get_bitmap()
  2026-10-22 · Duc Anh Luu <hidden>
• WARM1d [PATCH] netfilter: nf_conntrack_sip: fix out-of-bounds read in ct_sip_parse_transport()
  2026-10-22 · Duc Anh Luu <hidden>
• HOTtoday REVIEWED: 1 (0M) [PATCH nf] netfilter: nf_nat: do not link a conntrack twice into nat_bysource
  2026-10-22 · Vimal Agrawal <hidden>
• DORMANTno replies [PATCH nf] netfilter: flowtable: extend ct timeout of offloaded GRE flows
  2026-10-20 · Michail Andreas Michalopoulos <hidden>
• COOLING5d [PATCH 2/2] selftests: netfilter: add bridge conntrack test for vlan protocol mismatch
  2026-10-20 · Laveesh Bansal <hidden>
• COOLING6d REVIEWED: 2 (1M) [PATCH net 10/10] netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 09/10] netfilter: flowtable: reset transport header after nf_flow_encap_pop()
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 08/10] netfilter: xt_dccp: handle reserved options as single-byte
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 03/10] ipvs: fix more races around the overload flag
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 07/10] netfilter: nft_set_rbtree: narrow down range completion to anonymous sets
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 05/10] netfilter: flowtable: use the vlan id, not the full tci, in the tuple key
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d [PATCH net 02/10] netfilter: nft_payload: restrict checksum offsets to known values
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING6d REVIEWED: 1 (1M) [PATCH net 04/10] ipvs: skip committing sync_threshold when proc_dointvec fails
  2026-10-19 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d [PATCH AUTOSEL 6.18-5.10] netfilter: nf_tables: call skb_valid_dst() before skb_dst()
  2026-10-19 · Sasha Levin <sashal@kernel.org>
• COOLING7d [PATCH AUTOSEL 6.18-5.10] netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
  2026-10-19 · Sasha Levin <sashal@kernel.org>
• DORMANTno replies [PATCH nf] netfilter: flowtable: fix pmtu discovery in nf_flow_tunnel_ip6ip6_push()
  2026-10-19 · Lorenzo Bianconi <hidden>
• COOLING9d REVIEWED: 1 (0M) [PATCH] netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter
  2026-10-19 · liuc63 <hidden>
• COOLING7d [PATCH net-next 15/15] netfilter: flowtable: unify tunnel push for IPv4 and IPv6
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d [PATCH net-next 14/15] netfilter: flowtable: add encap_proto to flow_offload_tunnel
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d [PATCH net-next 13/15] netfilter: flowtable: populate tunnel tuple regardless of inner protocol
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d [PATCH net-next 12/15] netfilter: flowtable: set inner protocol when popping tunnel header
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d [PATCH net-next 11/15] netfilter: nft_compat: restrict raw table targets/matches
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>
• COOLING7d REVIEWED: 1 (0M) [PATCH net-next 10/15] selftests: netfilter: fix return value in zone subtest
  2026-10-18 · Pablo Neira Ayuso <pablo@netfilter.org>

Needs attention (review trailers in, no pickup)

Patches with review trailers that haven't landed in mainline and haven't been Acked by a maintainer. Oldest first.

• DORMANTno replies REVIEWED: 1 (0M) [PATCH AUTOSEL 6.18] netfilter: xt_multiport: validate range encoding in checkentry
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Tested-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH AUTOSEL 6.18] netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH AUTOSEL 7.0] netfilter: require Ethernet MAC header before using eth_hdr()
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Tested-by
• STALE182d REVIEWED: 1 (0M) [PATCH net 07/11] netfilter: reject zero shift in nft_bitwise +10 more in this series
  2026-04-24 · Pablo Neira Ayuso <pablo@netfilter.org> · 1 Reviewed-by
• STALE182d REVIEWED: 1 (0M) [PATCH net 7/8] netfilter: reject zero shift in nft_bitwise +7 more in this series
  2026-04-28 · Pablo Neira Ayuso <pablo@netfilter.org> · 1 Reviewed-by
• STALE172d REVIEWED: 1 (0M) [PATCH net 05/13] netfilter: x_tables: add and use xtables_unregister_table_exit +12 more in this series
  2026-05-07 · Pablo Neira Ayuso <pablo@netfilter.org> · 1 Reviewed-by
• STALE161d REVIEWED: 1 (0M) [PATCH net 04/12] netfilter: nft_inner: Fix IPv6 inner_thoff desync +11 more in this series
  2026-05-16 · Pablo Neira Ayuso <pablo@netfilter.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH nf] netfilter: disable payload mangling in userns
  2026-05-16 · Qi Tang <hidden> · 1 Tested-by
• STALE155d REVIEWED: 1 (0M) [PATCH net 02/10] netfilter: synproxy: refresh tcphdr after skb_ensure_writable +9 more in this series
  2026-05-22 · Florian Westphal <fw@strlen.de> · 1 Reviewed-by
• STALE154d REVIEWED: 1 (0M) [PATCH net-next 03/11] netfilter: allow nfnetlink built-in only +10 more in this series
  2026-05-25 · Florian Westphal <fw@strlen.de> · 1 Reviewed-by

Quiet for 30+ days

Patches with no review trailers and no replies. Either the author is heads-down elsewhere or these slipped through. Oldest first.

• STALE203d [PATCH net-next 02/13] netfilter: nf_tables: Fix typo in enum description +12 more in this series
  2026-04-07 · Florian Westphal <fw@strlen.de>
• STALE202d [PATCH net 5/7] netfilter: nft_ct: fix use-after-free in timeout object destroy +6 more in this series
  2026-04-08 · Florian Westphal <fw@strlen.de>
• DORMANTno replies [PATCH][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings
  2026-04-08 · Gustavo A. R. Silva <gustavoars@kernel.org>
• STALE201d [PATCH RFC net-next 2/4] nf_flow_table: track sub-interface and bridge ifindex in flow tuple +3 more in this series
  2026-04-09 · Daniel Golle <daniel@makrotopia.org>
• DORMANTno replies [PATCH v3][next] netfilter: x_tables: Avoid a couple -Wflex-array-member-not-at-end warnings
  2026-04-09 · Gustavo A. R. Silva <gustavoars@kernel.org>
• STALE198d [PATCH net-next 02/11] ipvs: add ip_vs_status info +10 more in this series
  2026-04-10 · Florian Westphal <fw@strlen.de>
• DORMANTno replies [PATCH] netfilter: nfnl_cthelper: apply per-class values when updating policies
  2026-04-11 · David Carlier <hidden>
• STALE196d Re: [PATCH] netfilter: nfnetlink_osf: fix null-ptr-deref in nf_osf_ttl
  2026-04-14 · Pablo Neira Ayuso <pablo@netfilter.org>
• STALE194d [PATCH net 13/14] netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase +13 more in this series
  2026-04-16 · Pablo Neira Ayuso <pablo@netfilter.org>
• STALE194d [PATCH net 07/11] netfilter: nat: use kfree_rcu to release ops +10 more in this series
  2026-04-16 · Pablo Neira Ayuso <pablo@netfilter.org>