[PATCH net,v2 0/4] Netfilter fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

v2: - reword the commit description of the nf_nat_register_fn() to
      explicitly refer to the memleak, so LLM does not get confused.
    - drop the xt_IDLETIMER and module = THIS_MODULE in netlink_dump.
    - keep back IPVS fix as Julian prefer to send a v2. 
-o-

Hi,

The following patchset contains Netfilter fixes for net:

1) Fix KMSAN reports an uninit-value in nf_nat_setup_info() for netmap,
   from Theodor Arsenij Larionov Trichkine.
 
2) Restrict deletion of netdevice in basechain and flowtable to exact
   matching only, from Fernando F. Mancera.
 
3) Fix nf_nat_register_fn() error path allowing for a memleak.
 
4) Hold reference on ct until flow is released to address, otherwise
   access to release ct->ext or different ct due to typesafe RCU
   semantics.
 
Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-11

Thanks.

----------------------------------------------------------------

The following changes since commit 78445023439506ebd83b86d40b1e428a3b309d4a:

  Merge tag 'net-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-09-10 14:07:48 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-11

for you to fetch changes up to e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d:

  netfilter: flowtable: hold reference on ct until flow is released (2026-09-11 13:04:15 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-11

----------------------------------------------------------------
Fernando Fernandez Mancera (1):
      netfilter: nf_tables: fix device name and prefix match in hook lookup

Pablo Neira Ayuso (2):
      netfilter: nf_nat: unregister and release hooks on error
      netfilter: flowtable: hold reference on ct until flow is released

Theodor Arsenij Larionov Trichkine (1):
      netfilter: nft_nat: fully initialise new_addr in netmap setup

 net/netfilter/nf_flow_table_core.c | 12 ++++++++--
 net/netfilter/nf_nat_core.c        | 46 +++++++++++++++++++++++++-------------
 net/netfilter/nf_tables_api.c      | 22 ++++++++++--------
 net/netfilter/nft_nat.c            |  2 +-
 4 files changed, 54 insertions(+), 28 deletions(-)