netfilter · Maintained

Maintainers

• M Pablo Neira Ayuso <pablo@netfilter.org>
• M Florian Westphal <fw@strlen.de>
• R Phil Sutter <phil@nwl.cc>

Paths

• F include/linux/netfilter*
• F include/linux/netfilter/
• F include/net/netfilter/
• F include/uapi/linux/netfilter*
• F include/uapi/linux/netfilter/
• F net/*/netfilter.c
• F net/*/netfilter/
• F net/bridge/br_netfilter*.c
• F net/netfilter/
• F tools/testing/selftests/net/netfilter/

Last 30 days

Most active threads (last 7 days)

• HOTtoday [PATCH 6.12 0000/1102] 6.12.111-rc1 review
  2026-09-17 18:43 · 7 replies in 7d · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0000/1250] 6.18.53-rc1 review
  2026-09-17 17:24 · 7 replies in 7d · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM2d [PATCH 6.1.y 0/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 18:25 · 3 replies in 7d · Miguel Gazquez (Schneider Electric) <hidden>
• WARM2d [PATCH 6.6.y 0/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 18:24 · 3 replies in 7d · Miguel Gazquez (Schneider Electric) <hidden>
• HOTtoday [PATCH 6.12.y 0/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 18:23 · 3 replies in 7d · Miguel Gazquez (Schneider Electric) <hidden>
• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 07:47 · 0 replies in 7d · lvjunyu <hidden>
• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 07:46 · 0 replies in 7d · lvjunyu <hidden>
• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 07:41 · 0 replies in 7d · lvjunyu <hidden>
• COOLING4d FAILED: patch "[PATCH] netfilter: cttimeout: prevent UAF during module unload" failed to apply to 5.15-stable tree
  2026-09-17 01:33 · 5 replies in 7d · <gregkh@linuxfoundation.org>
• COOLING4d FAILED: patch "[PATCH] netfilter: nf_log: unregister loggers before per-net teardown" failed to apply to 5.10-stable tree
  2026-09-17 01:13 · 4 replies in 7d · <gregkh@linuxfoundation.org>

Active reviewers (last 30 days)

• Julian Anastasov <ja@ssi.bg>
  14 attestations (14 Acked-by) · last on 2026-09-17
• TencentOS Corvus AI <hidden>
  12 attestations (12 Reported-by) · last on 2026-09-14
• Florian Westphal <fw@strlen.de>
  6 attestations (6 Suggested-by) · last on 2026-09-12
• Stefano Brivio <hidden>
  6 attestations (6 Reviewed-by) · last on 2026-08-31
• Eulgyu Kim <hidden>
  3 attestations (3 Reported-by) · last on 2026-09-17
• Jaeyoung Chung <hidden>
  3 attestations (3 Reported-by) · last on 2026-09-17
• Fernando Fernandez Mancera <hidden>
  3 attestations (3 Reviewed-by) · last on 2026-09-17
• Yuan Tan <hidden>
  2 attestations (2 Reported-by) · last on 2026-09-12
• Yifan Wu <hidden>
  2 attestations (2 Reported-by) · last on 2026-09-12
• Juefei Pu <hidden>
  2 attestations (2 Reported-by) · last on 2026-09-12

Recent patches

Most-recent 30 patches in this subsystem on stable (capped at 30), ordered by date desc.

• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 · lvjunyu <hidden>
• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 · lvjunyu <hidden>
• DORMANTno replies [PATCH] netfilter: nf_nat: Fix stale outer UDP checksum on VXLAN encapsulated packets
  2026-09-20 · lvjunyu <hidden>
• DORMANTno replies [PATCH 6.1.y 3/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• WARM2d [PATCH 6.1.y 2/3] netfilter: conntrack: check NULL when retrieving ct extension
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• WARM2d [PATCH 6.1.y 1/3] netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• DORMANTno replies [PATCH 6.6.y 3/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• WARM2d [PATCH 6.6.y 2/3] netfilter: conntrack: check NULL when retrieving ct extension
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• WARM2d [PATCH 6.6.y 1/3] netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• HOTtoday [PATCH 6.12.y 3/3] netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• HOTtoday [PATCH 6.12.y 2/3] netfilter: conntrack: check NULL when retrieving ct extension
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• HOTtoday [PATCH 6.12.y 1/3] netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
  2026-09-18 · Miguel Gazquez (Schneider Electric) <hidden>
• HOTtoday [PATCH 6.12 0708/1102] netfilter: nfnetlink_log: cope with concurrent instance destruction
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday [PATCH 6.12 0625/1102] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday REVIEWED: 1 (1M) [PATCH 6.12 0624/1102] ipvs: fix reversed sequence option serialization
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday [PATCH 6.12 0463/1102] netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday [PATCH 6.12 0373/1102] netfilter: nf_conntrack_expect: zero at allocation time
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday [PATCH 6.12 0400/1102] netfilter: ipset: mark the rcu locked areas properly
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• HOTtoday REVIEWED: 1 (0M) [PATCH 6.12 0241/1102] netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0848/1250] netfilter: nfnetlink_log: cope with concurrent instance destruction
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0733/1250] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d REVIEWED: 1 (1M) [PATCH 6.18 0732/1250] ipvs: fix reversed sequence option serialization
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0566/1250] netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0477/1250] netfilter: nf_conntrack_expect: zero at allocation time
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 6.18 0504/1250] netfilter: ipset: mark the rcu locked areas properly
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d REVIEWED: 1 (0M) [PATCH 6.18 0347/1250] netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 7.2 336/733] netfilter: nfnetlink_log: cope with concurrent instance destruction
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d [PATCH 7.2 201/733] netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• WARM1d REVIEWED: 1 (1M) [PATCH 7.2 200/733] ipvs: fix reversed sequence option serialization
  2026-09-17 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• DORMANTno replies [PATCH 5.15.y 5/5] netfilter: cttimeout: prevent UAF during module unload
  2026-09-17 · Sasha Levin <sashal@kernel.org>

Needs attention (review trailers in, no pickup)

Patches with review trailers that haven't landed in mainline and haven't been Acked by a maintainer. Oldest first.

• STALE174d REVIEWED: 1 (0M) [PATCH AUTOSEL 6.19-5.10] netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
  2026-03-30 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH v6.6] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
  2026-04-13 · Keerthana K <hidden> · 1 Reviewed-by
• STALE160d REVIEWED: 1 (0M) [PATCH v5.15-v6.1] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
  2026-04-13 · Keerthana K <hidden> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH v5.10] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
  2026-04-13 · Keerthana K <hidden> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH v2 v5.15-v6.1] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
  2026-04-14 · Keerthana K <hidden> · 1 Reviewed-by
• DORMANTno replies REVIEWED: 1 (0M) [PATCH v5.10] netfilter: nft_set_pipapo: do not rely on ZERO_SIZE_PTR
  2026-04-14 · Keerthana K <hidden> · 1 Reviewed-by
• STALE152d REVIEWED: 1 (0M) [PATCH AUTOSEL 6.18] netfilter: xt_multiport: validate range encoding in checkentry
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Tested-by
• STALE122d REVIEWED: 1 (0M) [PATCH AUTOSEL 6.18] netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Reviewed-by
• STALE122d REVIEWED: 1 (0M) [PATCH AUTOSEL 7.0] netfilter: require Ethernet MAC header before using eth_hdr()
  2026-04-20 · Sasha Levin <sashal@kernel.org> · 1 Tested-by
• COLD59d REVIEWED: 1 (0M) FAILED: patch "[PATCH] netfilter: nft_set_pipapo: don't leak bad clone into future" failed to apply to 6.1-stable tree
  2026-07-20 · <gregkh@linuxfoundation.org> · 1 Reviewed-by

Quiet for 30+ days

Patches with no review trailers and no replies. Either the author is heads-down elsewhere or these slipped through. Oldest first.

• STALE204d [PATCH 6.19 345/781] netfilter: nf_tables: reset table validation state on abort
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 408/781] netfilter: nfnetlink_queue: optimize verdict lookup with hash table
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 410/781] netfilter: nft_set_hash: fix get operation on big endian
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 411/781] netfilter: nft_counter: fix reset of counters on 32bit archs
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 412/781] netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 413/781] netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 414/781] netfilter: nft_set_rbtree: translate rbtree to array for binary search
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 415/781] netfilter: nft_set_rbtree: use binary search array in get command
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 416/781] netfilter: nft_set_rbtree: remove seqcount_rwlock_t
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>
• STALE204d [PATCH 6.19 418/781] netfilter: nft_set_rbtree: validate element belonging to interval
  2026-02-25 · Greg Kroah-Hartman <gregkh@linuxfoundation.org>