Re: [SECURITY] netfilter: nft_limit byte-rate bypass via unchecked u64 multiplication

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Sun, Oct 11, 2026 at 10:27:07PM +0100, SaifAllah benMassaoud wrote:
> The fact that the kernel does not crash does not, by itself, determine
> whether a bug is security-relevant ( I mean that a security vulnerability
> does not have to crash the kernel to be a security issue) .
> 
> My PoC demonstrates that the byte-rate limit can be bypassed due to an
> arithmetic overflow, allowing traffic that should have been rate-limited to
> pass.
> I understand that bytes/week is an unusual configuration.

It is the user itself that configured this esoteric ratelimit...

> However, nftables accepts it, and the issue is that the kernel
> incorrectly enforces the resulting rule. If this configuration is
> not intended to be supported, rejecting it would be a reasonable
> fix.
> My question is whether the security implications of the demonstrated
> rate-limit bypass were evaluated, rather than whether this is a common
> rate-limit configuration.

We are busy handling _real_ issues, please stop the bullshit.