[6.18.y request] netfilter: restrict payload mangling

[6.18.y request] netfilter: restrict payload mangling

[Florian Westphal]

Hi Sasha, Greg,

Could you please pick up following commits for 6.18.x kernel?

Sam Dlinn reports just another heap OOB + container escape.
Root cause is that many parts of network stack rely on network/transport
headers not changing after their validation.

One way to alter them post-validation is via netfilter: userspace
queueing and payload rewrite via nf_tables.

These patches:
1. Disable nfqueue and nft payload rewrites in user namespaces
2. Restrict rewrites to header fields deemed safe, e.g.
stateless NAT / ip address rewrites are still possible in normal
network namespaces.

None of these patches had Cc stable because they intentionally
break existing features.

I checked:

1. they apply cleanly in this order to 6.18.x stable
2. netfilter kselftests still pass
3. nftables.git shell tests pass (minus one unrelated error that
   is also there without them).

968cc2c96390 ("netfilter: disable payload mangling in userns")
3744b0964d52 ("ipv6: Implement limits on extension header parsing") [1]
54f34607d184 ("netfilter: nfnetlink_queue: restrict writes to network header")
3785091c6c16 ("netfilter: nft_meta: add double-tagged vlan and pppoe support") [2]
df07998dfd40 ("netfilter: nftables: restrict linklayer and network header writes")
c3716a3c4346 ("netfilter: nftables: restrict checkum update offset")
112e447d17f7 ("netfilter: validate L4 headers after userspace packet writes")
c2226f0c7fe9 ("netfilter: nft_payload: restrict checksum offsets to known values")
63bac0278603 ("netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables") [3]

[1] Is a dependency, it adds the IP6_MAX_EXT_HDRS_CNT define used
    in 'netfilter: nfnetlink_queue: restrict writes to network header'.

[2] Is a dependency, it adds the 'ethertype' field used in the patch
    coming afterwards.  If you don't like that, I can try to mangle
    the 'linklayer and network header writes' patch to use
    skb->protocol instead.

[3] is unrelated, while running the nftables tests kmemleak reported
    a splat that is fixed by that patch.

Re: [6.18.y request] netfilter: restrict payload mangling

[Sasha Levin]

On 2026-11-04, Florian Westphal <fw@strlen.de> wrote:
> Could you please pick up following commits for 6.18.x kernel?

Queued all nine for 6.18, thanks. 7.3 was still missing the checksum offset
patch from the series, so I queued that one there as well.

-- 
Thanks,
Sasha