Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

On Wed, Mar 04, 2026 at 10:36:20AM +1100, Steven Haigh wrote:
> Hi all,
> 
> Firstly, please CC me in replies as I'm not subscribed to the list.
> 
> I am currently loading some named sets into nftables using the following
> configuration:
> 
> set au-ipv4 {
>         type ipv4_addr
>         flags interval
>         auto-merge
>         elements = { $AU.ipv4 }
> }
> 
> set au-ipv6 {
>         type ipv6_addr
>         flags interval
>         auto-merge
>         elements = { $AU.ipv6 }
> }
> 
> These sets are loaded in the config via:
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
> include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";
> 
> The files are created using the geo-nft.sh script here:
> https://raw.githubusercontent.com/wirefalls/geo-nft/main/geo-nft.sh
> 
> When loading these, I get the following fatal error:
> netlink: Error: Could not process rule: No buffer space available
>
> This only seems to happen on the aarch64 installs. The same kernel version +
> tools version on x86_64 architecture seems to load just fine.
> 
> $ cat /proc/version
> Linux version 6.18.15-200.fc43.aarch64
> (mockbuild@835a9c7eeabc46d3b99996c22f20c9cf) (gcc (GCC) 15.2.1 20260123 (Red
> Hat 15.2.1-7), GNU ld version 2.45.1-4.fc43) #1 SMP PREEMPT_DYNAMIC Fri Feb
> 27 22:55:30 UTC 2026
> 
> $ nft --version
> nftables v1.1.3 (Commodore Bullmoose #4)

Can you try latest nftables version to confirm this bug on aarch64 is
current? Otherwise, try nftables git HEAD snapshot?

> I've had no success in hunting for why this would be the case.
> 
> I've found that I can batch-load the sets in ~500 rules at a time, and the
> entire set will load - but including them at the nftables service level
> always fails.
> 
> How should I fix this?
> 
> -- 
> Steven Haigh
> 
> 📧 netwiz@crc.id.au
> 💻 https://crc.id.au
> 
> 
>