Re: aarch64 - netlink: Error: Could not process rule: No buffer space available

Pablo Neira Ayuso
2026-03-04T00:17:06Z

On Wed, Mar 04, 2026 at 01:02:14AM +0100, Pablo Neira Ayuso wrote:
> Hi,
>
> On Wed, Mar 04, 2026 at 10:36:20AM +1100, Steven Haigh wrote:
> > Hi all,
> >
> > Firstly, please CC me in replies as I'm not subscribed to the list.
> >
> > I am currently loading some named sets into nftables using the following
> > configuration:
> >
> > set au-ipv4 {
> > type ipv4_addr
> > flags interval
> > auto-merge
> > elements = { $AU.ipv4 }
> > }
> >
> > set au-ipv6 {
> > type ipv6_addr
> > flags interval
> > auto-merge
> > elements = { $AU.ipv6 }
> > }
> >
> > These sets are loaded in the config via:
> > include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv4";
> > include "/etc/nftables/firewall/geo-nft/countrysets/AU.ipv6";
> >
> > The files are created using the geo-nft.sh script here:
> > https://raw.githubusercontent.com/wirefalls/geo-nft/main/geo-nft.sh
> >
> > When loading these, I get the following fatal error:
> > netlink: Error: Could not process rule: No buffer space available

Just to be sure and discard something simple.

Maybe you made a mistake in your ruleset in the aarch64 box? With lots
of errors coming from the kernel, older userspace nftables versions
report ENOBUFS.

Try loading AU.ipv4 and AU.ipv6 with only one element to see if
userspace reports a different error.

commit 47e9aaf0227daf16f43a7442e1dceae8851817a5
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date: Tue Aug 26 10:09:13 2025 +0200

mnl: continue on ENOBUFS errors when processing batch

A user reports that:

nft -f ruleset.nft

fails with:

netlink: Error: Could not process rule: No buffer space available

This was triggered by:

table ip6 fule {
set domestic_ip6 {
type ipv6_addr
flags dynamic,interval
elements = $domestic_ip6
}
chain prerouting {
type filter hook prerouting priority 0;
ip6 daddr @domestic_ip6 counter
}
}

where $domestic_ip6 contains a large number of IPv6 addresses.

This set declaration is not supported currently, because dynamic sets
with intervals are not supported, then every IPv6 address that is added
triggers an error, overruning the userspace socket buffer with lots of
NLMSG_ERROR messages (or too big NLMSG_ERROR message to fit into the
socket buffer)

> > This only seems to happen on the aarch64 installs. The same kernel version +
> > tools version on x86_64 architecture seems to load just fine.
> >
> > $ cat /proc/version
> > Linux version 6.18.15-200.fc43.aarch64
> > (mockbuild@835a9c7eeabc46d3b99996c22f20c9cf) (gcc (GCC) 15.2.1 20260123 (Red
> > Hat 15.2.1-7), GNU ld version 2.45.1-4.fc43) #1 SMP PREEMPT_DYNAMIC Fri Feb
> > 27 22:55:30 UTC 2026
> >
> > $ nft --version
> > nftables v1.1.3 (Commodore Bullmoose #4)
>
> Can you try latest nftables version to confirm this bug on aarch64 is
> current? Otherwise, try nftables git HEAD snapshot?
>
> > I've had no success in hunting for why this would be the case.
> >
> > I've found that I can batch-load the sets in ~500 rules at a time, and the
> > entire set will load - but including them at the nftables service level
> > always fails.
> >
> > How should I fix this?
> >
> > --
> > Steven Haigh
> >
> > 📧 netwiz@crc.id.au
> > 💻 https://crc.id.au
> >
> >
> >
>