netfilter

Most active threads (last 7 days)

Recent patches

Latest 30 postings or standalone patches (up to 30), newest first. Counts below cover matching patches in stable touching this subsystem.

• [PATCH net] ipvs: wait for RCU callbacks before dst_ops teardown 2026-11-14 · <hidden>
• [PATCH 5.15.y 1/2] netfilter: conntrack: skip verification of zero UDP checksum 2026-11-10 · Sasha Levin <sashal@kernel.org>
• nft_byteorder: fix the uninitialised-stack read without removing multi-register support v1 · 2 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.12.y 1/2] Revert "netfilter: nft_byteorder: remove multi-register support" 2026-11-09
  • [PATCH 6.12.y 2/2] netfilter: nft_byteorder: initialise the marked destination span 2026-11-09
  2026-11-09 · Abdifatah Suruur <hidden>
• 7.3.4-rc1 review v1 · 1 matching patch

  Entire posting: PENDING · 775 of 1257 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 7.3 0321/1257] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter 2026-11-07
  2026-11-07 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 6.18.63-rc1 review v1 · 1 matching patch

  Entire posting: PENDING · 525 of 869 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.18 260/869] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter 2026-11-07
  2026-11-07 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 6.12.117-rc1 review v1 · 5 matching patches

  Entire posting: PENDING · 794 of 1536 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.12 0247/1536] netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets 2026-11-07
  • [PATCH 6.12 0248/1536] netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-11-07
  • [PATCH 6.12 0448/1536] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-11-07
  • [PATCH 6.12 0839/1536] netfilter: conntrack: always lower timeout for non-closing RST packets 2026-11-07
  • [PATCH 6.12 1081/1536] netfilter: ctnetlink: fix inverted IPv6 address match in dump filter 2026-11-07
  2026-11-07 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• [PATCH] netfilter: nf_tables: fix pernet use-after-free on UNREGISTER rebroadcast 2026-11-05 · Henry Martin <hidden>
• [PATCH net] netfilter: nf_flow_table: defer pernet stats release to last flowtable teardown 2026-11-05 · Qihang <hidden>
• 6.18.61-rc1 review v1 · 15 matching patches

  Entire posting: PENDING · 472 of 1005 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.18 0301/1005] netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets 2026-11-04
  • [PATCH 6.18 0302/1005] netfilter: nf_tables: call skb_valid_dst() before skb_dst() 2026-11-04
  • [PATCH 6.18 0537/1005] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations 2026-11-04
  • [PATCH 6.18 0538/1005] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-11-04
  • [PATCH 6.18 0539/1005] netfilter: ctnetlink: do not expose expectation DEAD flag 2026-11-04
  • [PATCH 6.18 0811/1005] netfilter: disable payload mangling in userns 2026-11-04
  • [PATCH 6.18 0813/1005] netfilter: nfnetlink_queue: restrict writes to network header 2026-11-04
  • [PATCH 6.18 0814/1005] netfilter: nft_meta: add double-tagged vlan and pppoe support 2026-11-04
  • [PATCH 6.18 0815/1005] netfilter: nftables: restrict linklayer and network header writes 2026-11-04
  • [PATCH 6.18 0816/1005] netfilter: nftables: restrict checkum update offset 2026-11-04
  • [PATCH 6.18 0817/1005] netfilter: validate L4 headers after userspace packet writes 2026-11-04
  • [PATCH 6.18 0818/1005] netfilter: nft_payload: restrict checksum offsets to known values 2026-11-04
  • [PATCH 6.18 0819/1005] netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables 2026-11-04
  • [PATCH 6.18 0824/1005] Revert "net: Convert proto_ops bind() callbacks to use sockaddr_unsized" 2026-11-04
  • [PATCH 6.18 1003/1005] netfilter: conntrack: always lower timeout for non-closing RST packets 2026-11-04
  2026-11-04 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 7.3.2-rc1 review v1 · 1 matching patch

  Entire posting: PENDING · 270 of 547 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 7.3 334/547] netfilter: nft_payload: restrict checksum offsets to known values 2026-11-04
  2026-11-04 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• [PATCH nf] netfilter: flowtable: remove hw flows before unbinding the flow block 2026-11-03 · Arnau Valls <hidden>
• [PATCH nf] netfilter: flowtable: remove hw flows before unbinding the flow block 2026-11-03 · Arnau Valls <hidden>
• [PATCH 6.18] Revert "net: Convert proto_ops bind() callbacks to use sockaddr_unsized" 2026-11-03 · Hazem Mohamed Abuelfotoh <hidden>
• ipvs: keep templates and cport 0 conns away from packet lookups v2 · 2 matching patches

  Entire posting: PENDING · 1 of 2 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH nf v2 1/2] ipvs: validate cport in received sync records 2026-11-03
  • [PATCH nf v2 2/2] ipvs: skip cport 0 connections in ip_vs_conn_out_get() 2026-11-03
  2026-11-03 · Axel Mierczuk <hidden>
• proc: fix a few old bugs in /proc handlers rfc · 1 matching patch

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH RFC 03/38] netfilter: xt_recent: don't remove the proc entries under a spinlock 2026-11-02
  2026-11-02 · Christian Brauner <brauner@kernel.org>
• Few CVE backports to 5.10.y v1 · 1 matching patch

  Entire posting: PENDING · 6 of 9 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 5.10.y 4/9] netfilter: nf_tables: fix use-after-free in nf_tables_addchain() 2026-11-02
  2026-11-02 · Harshit Mogalapalli <hidden>
• Few CVE backports to 5.15.y v1 · 1 matching patch

  Entire posting: PENDING · 8 of 11 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 5.15.y 02/11] netfilter: nf_tables: fix use-after-free in nf_tables_addchain() 2026-11-02
  2026-11-02 · Harshit Mogalapalli <hidden>
• [PATCH 6.1.y] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-11-01 · Joas Antonio dos Santos <hidden>
• [PATCH 6.12.y] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-11-01 · Joas Antonio dos Santos <hidden>
• [PATCH 6.6.y] netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() 2026-11-01 · Joas Antonio dos Santos <hidden>
• [PATCH net] netfilter: xt_recent: do not call remove_proc_entry() under recent_lock 2026-10-28 · Cen Zhang (Microsoft) <hidden>
• 6.1.191-rc1 review v1 · 41 matching patches

  Entire posting: PENDING · 1031 of 1887 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  Showing first 30 of 41 matching patches (preview limited to 30).

  • [PATCH 6.1 0155/1887] netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST 2026-10-28
  • [PATCH 6.1 0156/1887] netfilter: nf_tables: skip expired catchall elements on insert and delete 2026-10-28
  • [PATCH 6.1 0177/1887] netfilter: nft_flow_offload: drop flowtable reference on init error path 2026-10-28
  • [PATCH 6.1 0232/1887] netfilter: ipset: do not update comments from kernel-side adds 2026-10-28
  • [PATCH 6.1 0241/1887] ipvs: fix missing counter decrement in lblc 2026-10-28
  • [PATCH 6.1 0242/1887] ipvs: do not create invisible templates 2026-10-28
  • [PATCH 6.1 0243/1887] ipvs: filter some flags received in the backup server 2026-10-28
  • [PATCH 6.1 0244/1887] netfilter: bpf: reject invalid NAT manipulation types 2026-10-28
  • [PATCH 6.1 0246/1887] net: add and use skb_get_hash_net 2026-10-28
  • [PATCH 6.1 0307/1887] ipvs: bound LBLCR and LBLC cache growth 2026-10-28
  • [PATCH 6.1 0428/1887] netfilter: nft_set_pipapo: restore cloned mapping table memcg accounting 2026-10-28
  • [PATCH 6.1 0520/1887] netfilter: nf_tables: fix bidirectional offload regression 2026-10-28
  • [PATCH 6.1 0600/1887] netfilter: nf_tables: fix memleak in map from abort path 2026-10-28
  • [PATCH 6.1 0704/1887] netfilter: IDLETIMER: Fix for possible ABBA deadlock 2026-10-28
  • [PATCH 6.1 1029/1887] ipvs: do not keep dest_dst if dev is going down 2026-10-28
  • [PATCH 6.1 1067/1887] netfilter: nf_tables: use list_del_rcu for netlink hooks 2026-10-28
  • [PATCH 6.1 1076/1887] netfilter: nat: use kfree_rcu to release ops 2026-10-28
  • [PATCH 6.1 1100/1887] netfilter: nft_ct: bail out on template ct in get eval 2026-10-28
  • [PATCH 6.1 1131/1887] netfilter: nf_tables: Extend nft_expr_ops::dump callback parameters 2026-10-28
  • [PATCH 6.1 1132/1887] netfilter: nf_tables: fix dst corruption in same register operation 2026-10-28
  • [PATCH 6.1 1221/1887] netfilter: nft_fib: reject fib expression on the netdev egress hook 2026-10-28
  • [PATCH 6.1 1222/1887] netfilter: nft_lookup: fix catchall element handling with inverted lookups 2026-10-28
  • [PATCH 6.1 1237/1887] netfilter: nft_compat: ebtables emulation must reject non-bridge targets 2026-10-28
  • [PATCH 6.1 1239/1887] bpf: Guard conntrack opts error writes 2026-10-28
  • [PATCH 6.1 1261/1887] netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount 2026-10-28
  • [PATCH 6.1 1294/1887] netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() 2026-10-28
  • [PATCH 6.1 1301/1887] bpf: Fix netns reference imbalance in conntrack kfuncs 2026-10-28
  • [PATCH 6.1 1311/1887] ipvs: revalidate ihl to prevent out-of-bounds access 2026-10-28
  • [PATCH 6.1 1323/1887] netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag 2026-10-28
  • [PATCH 6.1 1324/1887] netfilter: make nftables drops visible in net dropmonitor 2026-10-28
  2026-10-28 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 5.15.224-rc1 review v1 · 16 matching patches

  Entire posting: PENDING · 281 of 571 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 5.15 120/571] netfilter: nf_tables: set->ops->insert returns opaque set element in case of EEXIST 2026-10-28
  • [PATCH 5.15 121/571] netfilter: nf_tables: skip expired catchall elements on insert and delete 2026-10-28
  • [PATCH 5.15 139/571] netfilter: nft_flow_offload: drop flowtable reference on init error path 2026-10-28
  • [PATCH 5.15 176/571] netfilter: ipset: do not update comments from kernel-side adds 2026-10-28
  • [PATCH 5.15 182/571] ipvs: fix missing counter decrement in lblc 2026-10-28
  • [PATCH 5.15 183/571] ipvs: do not create invisible templates 2026-10-28
  • [PATCH 5.15 184/571] ipvs: filter some flags received in the backup server 2026-10-28
  • [PATCH 5.15 185/571] netfilter: nf_tables: avoid skb access on nf_stolen 2026-10-28
  • [PATCH 5.15 186/571] net: add and use skb_get_hash_net 2026-10-28
  • [PATCH 5.15 229/571] ipvs: bound LBLCR and LBLC cache growth 2026-10-28
  • [PATCH 5.15 411/571] netfilter: nf_tables: release flowtable after rcu grace period on error 2026-10-28
  • [PATCH 5.15 430/571] netfilter: nf_tables: fix bidirectional offload regression 2026-10-28
  • [PATCH 5.15 453/571] netfilter: nf_tables: fix crash when nf_trace is enabled 2026-10-28
  • [PATCH 5.15 538/571] netfilter: nf_tables: always walk all pending catchall elements 2026-10-28
  • [PATCH 5.15 552/571] netfilter: nf_tables: always increment set element count 2026-10-28
  • [PATCH 5.15 553/571] netfilter: nf_tables: unconditionally bump set->nelems before insertion 2026-10-28
  2026-10-28 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 6.6.161-rc1 review v1 · 1 matching patch

  Entire posting: PENDING · 83 of 168 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.6 034/168] net/ipv6: Introduce payload_len helpers 2026-10-28
  2026-10-28 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 5.10.273-rc1 review v1 · 13 matching patches

  Entire posting: PENDING · 261 of 516 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 5.10 141/516] netfilter: nft_flow_offload: drop flowtable reference on init error path 2026-10-28
  • [PATCH 5.10 166/516] netfilter: ipset: do not update comments from kernel-side adds 2026-10-28
  • [PATCH 5.10 172/516] ipvs: fix missing counter decrement in lblc 2026-10-28
  • [PATCH 5.10 173/516] ipvs: do not create invisible templates 2026-10-28
  • [PATCH 5.10 174/516] ipvs: filter some flags received in the backup server 2026-10-28
  • [PATCH 5.10 175/516] netfilter: nf_tables: avoid skb access on nf_stolen 2026-10-28
  • [PATCH 5.10 176/516] net: add and use skb_get_hash_net 2026-10-28
  • [PATCH 5.10 213/516] ipvs: bound LBLCR and LBLC cache growth 2026-10-28
  • [PATCH 5.10 377/516] netfilter: nf_tables: fix bidirectional offload regression 2026-10-28
  • [PATCH 5.10 401/516] netfilter: nf_tables: fix crash when nf_trace is enabled 2026-10-28
  • [PATCH 5.10 490/516] netfilter: nf_tables: release flowtable after rcu grace period on error 2026-10-28
  • [PATCH 5.10 501/516] netfilter: nf_tables: always increment set element count 2026-10-28
  • [PATCH 5.10 502/516] netfilter: nf_tables: unconditionally bump set->nelems before insertion 2026-10-28
  2026-10-28 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• 6.12.115-rc1 review v1 · 2 matching patches

  Entire posting: PENDING · 96 of 247 reviewed Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH 6.12 052/247] net/ipv6: Introduce payload_len helpers 2026-10-28
  • [PATCH 6.12 119/247] netfilter: nft_byteorder: remove multi-register support 2026-10-28
  2026-10-28 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• [PATCH nf v3] netfilter: ipset: fix double free on kernel-side delete during resize 2026-10-26 · Xue Boyang <hidden>
• [PATCH nf] netfilter: flowtable: remove hardware flows before unbinding 2026-10-26 · Paul-Louis Charrière <hidden>
• netfilter: nf_tables: unconditionally bump set->nelems before insertion v2 · 2 matching patches

  Entire posting: Pending Open cover letterLifecycle progress covers the full posting, including patches outside this subsystem and inbox.

  • [PATCH v2 5.15.y 1/2] netfilter: nf_tables: always increment set element count 2026-10-25
  • [PATCH v2 5.15.y 2/2] netfilter: nf_tables: unconditionally bump set->nelems before insertion 2026-10-25
  2026-10-25 · Steffen Pfendtner <hidden>
• [PATCH nf v2] netfilter: ipset: fix double free on kernel-side delete during resize 2026-10-25 · Xue Boyang <hidden>