[PATCH net 00/12] Netfilter/IPVS fixes for net

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

The following patchset contains Netfilter/IPVS fixes for net:

1) Reject malformed messages in IPVS sync, from Kyle Zeng.

2) Fix possible stale infoleak in IPVS sync, also from Kyle Zeng.

3) Out-of-bound read in the SIP conntrack helper, from
   Joas Antonio dos Santos.

4) UaF on cttimeout module removal, from Chengfeng Ye.

5) Unregister nf_loggers before netns teardown to fix UaF,
   also from Chengfeng Ye.

6) Limit IPVS cache growth for LBLCR and LBLC schedulers,
   from Zhiling Zou.

7) Restrict checksum offset to known supported protocols in
   nft_payload, from Florian Westphal.

8) Fix race in nfnetlink_log due to concurrent instance destruction,
   from Florian Westphal.

9) Hold nfnl mutex from event notifier path of nfnetlink_queue to deal
   with race between close() and UNBIND request on same portid, also
   from Florian.

10) Remove arp_table 32bit compat interface, this is already off in
    many distributions, from Florian Westphal.

11) Set IP6T_F_PROTO flag is e->ipv6.proto is set on to deal with
    insufficient validation of xtables extensions when used from
    legacy ip6tables, from Florian.

12) Set on the NLM_F_DUMP_FILTERED flag when all is filtering out
    in ctnetlink, from Ilya Maximets.

Please, pull these changes from:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git nf-26-09-03

Thanks.

----------------------------------------------------------------

The following changes since commit 1d2929d0850fff683b8aff051275945e65f082c8:

  net: psp: do not inherit the Rx association on clone (2026-09-01 15:12:24 +0200)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-26-09-03

for you to fetch changes up to 5dfd63737fb19c6b179799d3ae784673152f61eb:

  netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (2026-09-03 01:39:28 +0200)

----------------------------------------------------------------
netfilter pull request 26-09-03

----------------------------------------------------------------
Chengfeng Ye (2):
      netfilter: cttimeout: prevent UAF during module unload
      netfilter: nf_log: unregister loggers before per-net teardown

Florian Westphal (5):
      netfilter: nft_payload: restrict checksum offsets to known values
      netfilter: nfnetlink_log: cope with concurrent instance destruction
      netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
      netfilter: arp_tables: remove the 32bit compat interface
      netfilter: ip6_tables: set F_PROTO when proto value is nonzero

Ilya Maximets (1):
      netfilter: report NLM_F_DUMP_FILTERED when all is filtered out

Joas Antonio dos Santos (1):
      netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Kyle Zeng (2):
      ipvs: reject invalid states in connection template sync records
      ipvs: fix reversed sequence option serialization

Zhiling Zou (1):
      ipvs: bound LBLCR and LBLC cache growth

 include/linux/netfilter_arp/arp_tables.h |  19 --
 net/ipv4/netfilter/arp_tables.c          | 472 +------------------------------
 net/ipv6/netfilter/ip6_tables.c          |   5 +
 net/netfilter/ipvs/ip_vs_lblc.c          |   3 +
 net/netfilter/ipvs/ip_vs_lblcr.c         |   3 +
 net/netfilter/ipvs/ip_vs_sync.c          |  20 +-
 net/netfilter/nf_conntrack_netlink.c     |   2 +
 net/netfilter/nf_conntrack_sip.c         |   2 +-
 net/netfilter/nf_log_syslog.c            |   2 +-
 net/netfilter/nfnetlink_cttimeout.c      |   2 +-
 net/netfilter/nfnetlink_log.c            |  15 +-
 net/netfilter/nfnetlink_queue.c          |   8 +-
 net/netfilter/nft_payload.c              |  36 ++-
 13 files changed, 73 insertions(+), 516 deletions(-)