[PATCH net 0/9] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS fixes for net:

1) Fix splat with PREEMPT_RCU because smp_processor_id() in nfqueue,
   from Fernando Fernandez Mancera.

2) Fix possible use of pointer to old IPVS scheduler after RCU grace
   period when editing service, from Julian Anastasov.

3) Fix possible forever RCU walk over rt->fib6_siblings in nft_fib6,
   if rt is unlinked mid-iteration, apparently same issue happens in
   the fib6 core. From Jiayuan Chen.

4) Add mutex to guard refcount in synproxy infrastructure, since
   concurrent hook {un}registration can happen.
   From Fernando Fernandez Mancera.

5) Bail out if IRC conntrack helper fails to parse a command, do not
   try parsing using other command handlers, from Florian Westphal.
   This fixes a possible out-of-bound read.

6) Possible use-after-free in nft_tunnel by releasing template dst
   after all references has been dropped, from Tristan Madani.

7) Ignore conntrack template in nft_ct, from Jiayuan Chen.

8) Missing skb_ensure_writable() in ebt_snat, Yiming Qian.

9) Remove multi-register byteorder support, this allows for kernel
   stack info leak, from Florian Westphal.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-06-01

Thanks.

----------------------------------------------------------------

The following changes since commit 78ef59e7a6459b16f8102e0ee1c718443323d1af:

  Merge branch 'wireguard-fixes-for-7-1-rc6' (2026-05-29 13:01:31 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-06-01

for you to fetch changes up to bb061d3de41707415269be75ebf700efb03ec212:

  netfilter: nft_byteorder: remove multi-register support (2026-06-01 13:43:53 +0200)

----------------------------------------------------------------
netfilter pull request 26-06-01

----------------------------------------------------------------
Fernando Fernandez Mancera (2):
      netfilter: xt_NFQUEUE: prefer raw_smp_processor_id
      netfilter: synproxy: add mutex to guard hook reference counting

Florian Westphal (2):
      netfilter: conntrack_irc: fix possible out-of-bounds read
      netfilter: nft_byteorder: remove multi-register support

Jiayuan Chen (2):
      netfilter: nft_fib_ipv6: bail out of sibling walk if rt got unlinked
      netfilter: nft_ct: bail out on template ct in get eval

Julian Anastasov (1):
      ipvs: clear the svc scheduler ptr early on edit

Tristan Madani (1):
      netfilter: nft_tunnel: fix use-after-free on object destroy

Yiming Qian (1):
      netfilter: bridge: make ebt_snat ARP rewrite writable

 include/net/ip_vs.h               |  3 +--
 net/bridge/netfilter/ebt_snat.c   |  3 +++
 net/ipv6/netfilter/nft_fib_ipv6.c |  3 +++
 net/netfilter/ipvs/ip_vs_ctl.c    | 13 ++++++----
 net/netfilter/ipvs/ip_vs_sched.c  | 14 +++++------
 net/netfilter/nf_conntrack_irc.c  |  4 +--
 net/netfilter/nf_synproxy_core.c  | 24 +++++++++++++-----
 net/netfilter/nft_byteorder.c     | 51 +++++++++++++++------------------------
 net/netfilter/nft_ct.c            |  8 +++---
 net/netfilter/nft_ct_fast.c       |  2 +-
 net/netfilter/nft_tunnel.c        |  2 +-
 net/netfilter/xt_NFQUEUE.c        |  2 +-
 12 files changed, 68 insertions(+), 61 deletions(-)