[PATCH net 0/7] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset provides fixes for Netfilter/IPVS:

1) Fix KMSAN reports an uninit-value in nf_nat_setup_info() for netmap,
   from Theodor Arsenij Larionov Trichkine.

2) Restrict deletion of netdevice in basechain and flowtable to exact
   matching only, from Fernando F. Mancera.

3) Fix nf_nat_register_fn() error path allowing for a memleak.

4) Revalidate ihl before calling icmp_send() in IPVS,
   from Julian Anastasov.

5) Hold reference on ct until flow is released to address, otherwise
   access to release ct->ext or different ct due to typesafe RCU
   semantics.

6) Use kzalloc_obj() to allocate timer object in xt_IDLETIMER as
   reported by sashiko to address uninitialized access.

7) Hold reference on module during netlink for cttimeout, cthelper
   ctnetlink and nfnetlink_acct.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-10

Thanks.

----------------------------------------------------------------

The following changes since commit 1b8e56030d52cd3e52c9ad4df1985ad0440be67d:

  Merge tag 'nf-26-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf (2026-09-08 13:53:17 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-10

for you to fetch changes up to c56f665eeaf77cd19f0a09c8fa7628b744d5918d:

  netfilter: hold reference on module during netlink dump (2026-09-09 23:15:36 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-10

----------------------------------------------------------------
Fernando Fernandez Mancera (1):
      netfilter: nf_tables: fix device name and prefix match in hook lookup

Julian Anastasov (1):
      ipvs: revalidate ihl before icmp_send

Pablo Neira Ayuso (4):
      netfilter: nf_nat: unregister and release hooks on error
      netfilter: flowtable: hold reference on ct until flow is released
      netfilter: xt_IDLETIMER: allocate timer with kzalloc()
      netfilter: hold reference on module during netlink dump

Theodor Arsenij Larionov Trichkine (1):
      netfilter: nft_nat: fully initialise new_addr in netmap setup

 net/netfilter/ipset/ip_set_core.c    |  1 +
 net/netfilter/ipvs/ip_vs_core.c      |  9 ++++++-
 net/netfilter/nf_conntrack_netlink.c |  7 ++++++
 net/netfilter/nf_flow_table_core.c   | 11 +++++++--
 net/netfilter/nf_nat_core.c          | 46 +++++++++++++++++++++++-------------
 net/netfilter/nf_tables_api.c        | 22 ++++++++++-------
 net/netfilter/nfnetlink_acct.c       |  1 +
 net/netfilter/nfnetlink_cthelper.c   |  1 +
 net/netfilter/nfnetlink_cttimeout.c  |  1 +
 net/netfilter/nft_nat.c              |  2 +-
 net/netfilter/xt_IDLETIMER.c         |  2 +-
 11 files changed, 73 insertions(+), 30 deletions(-)