Show patches with: State = Action Required       |   231 patches
« 1 2 3 »
Patch Series A/F/R/T S/W/F Date Submitter Delegate State
[nft] limit: Support arbitrary unit values [nft] limit: Support arbitrary unit values - - - - --- 2024-04-13 Phil Sutter New
[nftables] include: fix for musl with iptables v1.8.11 [nftables] include: fix for musl with iptables v1.8.11 - - - - --- 2024-12-19 Alyssa Ross New
[nf] netfilter: conntrack: correct sequence on reinitialized TCP connection [nf] netfilter: conntrack: correct sequence on reinitialized TCP connection - 1 - - --- 2025-02-20 Pablo Neira Ayuso New
[V6] netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_max sysctl [V6] netfilter: netns nf_conntrack: per-netns net.netfilter.nf_conntrack_max sysctl - - - - --- 2025-04-15 lvxiafei Under Review
[nft,v2] src: Convert ip {s,d}addr to IPv4-mapped as needed [nft,v2] src: Convert ip {s,d}addr to IPv4-mapped as needed - - - - --- 2025-12-10 Phil Sutter New
[nft] datatype: Accept IPv4 addresses for ip6addr_type [nft] datatype: Accept IPv4 addresses for ip6addr_type - - - - --- 2025-12-10 Phil Sutter New
[nft] cache: Fix for multiple commands in a single batch [nft] cache: Fix for multiple commands in a single batch - 1 - - --- 2026-03-11 Phil Sutter New
netfilter: ipset: harden payload calculation in call_ad() netfilter: ipset: harden payload calculation in call_ad() 1 - - - --- 2026-03-13 David Baum kadlec Under Review
[nf-next,1/2] netfilter: add more netlink-based policy range checks [nf-next,1/2] netfilter: add more netlink-based policy range checks - - - - --- 2026-03-16 Florian Westphal Under Review
[nf-next,2/2] netfilter: nf_tables: add netlink policy based cap on registers [nf-next,1/2] netfilter: add more netlink-based policy range checks - - - - --- 2026-03-16 Florian Westphal Under Review
[v12,nf-next] bridge: Introduce DEV_PATH_BR_VLAN_KEEP_HW [v12,nf-next] bridge: Introduce DEV_PATH_BR_VLAN_KEEP_HW - - - - --- 2026-03-17 Eric Woudstra Needs Review / ACK
[nf-next,v2,1/2] netfilter: flowtable: update netdev stats with HW_OFFLOAD flows Update (DSA) netdev stats with offloaded flows - - - - --- 2026-03-24 Ahmed Zaki Needs Review / ACK
[nf-next,v2,2/2] net: dsa: update net_device stats with HW offloaded flows stats Update (DSA) netdev stats with offloaded flows - - - - --- 2026-03-24 Ahmed Zaki Needs Review / ACK
[nft,1/2] parser_json: Accept non-RHS expressions in binop RHS A bit of non-constant binop follow-up - 1 - - --- 2026-04-02 Phil Sutter New
[nft,2/2] parser_bison: Accept non-constant binop on LHS of relationals A bit of non-constant binop follow-up - - - - --- 2026-04-02 Phil Sutter New
[BUG] KASAN: slab-use-after-free in hash_ipportip6_resize [BUG] KASAN: slab-use-after-free in hash_ipportip6_resize - - - - --- 2026-04-23 Eulgyu Kim Under Review
[v20,nf-next,1/2] netfilter: utils: nf_ip(6)_checksum(_partial) correct data!=networkheader conntrack: bridge: add double vlan, pppoe and pppoe-in-q - - - - --- 2026-05-12 Eric Woudstra New
[v20,nf-next,2/2] netfilter: bridge: Add conntrack double vlan and pppoe conntrack: bridge: add double vlan, pppoe and pppoe-in-q - - - - --- 2026-05-12 Eric Woudstra New
[v5,nf-next] selftests: netfilter: Add bridge_fastpath.sh [v5,nf-next] selftests: netfilter: Add bridge_fastpath.sh - - - - --- 2026-05-12 Eric Woudstra New
[nf,1/1] netfilter: ipset: fix comment extension lifetime during hash resize [nf,1/1] netfilter: ipset: fix comment extension lifetime during hash resize - 1 - 1 --- 2026-05-13 Ren Wei kadlec Needs Review / ACK
[1/9,nf-next] netfilter: xtables: use DEBUG_NET_WARN_ON_ONCE in packet and control paths netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[3/9,nf-next] netfilter: nfnetlink: use DEBUG_NET_WARN_ON_ONCE for attribute validation netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[4/9,nf-next] netfilter: conntrack: use DEBUG_NET_WARN_ON_ONCE on packet paths netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[5/9,nf-next] netfilter: nat: use DEBUG_NET_WARN_ON_ONCE in core and helper paths netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[7/9,nf-next] netfilter: bpf: use DEBUG_NET_WARN_ON_ONCE for missing BTF structures netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[8/9,nf-next] netfilter: flowtable: use DEBUG_NET_WARN_ON_ONCE in offload path netfilter: replace raw warnings with - - - - --- 2026-06-01 Fernando Fernandez Mancera New
[nf-next] netfilter: flowtable: remove inline segmentation [nf-next] netfilter: flowtable: remove inline segmentation - - - - --- 2026-06-03 Qingfang Deng New
[nft,v2,1/5] libnftables: add nft_run_cmd_release() helper and use it support for several list and reset commands - - - - --- 2026-06-23 Pablo Neira Ayuso New
[nft,v2,2/5] libnftables: split nft_run_cmd_from_buffer() in helper functions support for several list and reset commands - - - - --- 2026-06-23 Pablo Neira Ayuso New
[nft,v2,3/5] libnftables: use nft_run_cmds() in nft_run_cmd_from_filename() support for several list and reset commands - - - - --- 2026-06-23 Pablo Neira Ayuso New
[nft,v2,4/5] src: allow reset commands in batch with list and get commands only support for several list and reset commands - - - - --- 2026-06-23 Pablo Neira Ayuso New
[nft,v2,5/5] libnftables: support for several reset commands support for several list and reset commands - 1 - - --- 2026-06-23 Pablo Neira Ayuso New
[nf,1/1] netfilter: xt_time: reject pre-epoch calendar matching [nf,1/1] netfilter: xt_time: reject pre-epoch calendar matching - 1 2 - --- 2026-07-03 Ren Wei New
[nf,v2] ipvs: make destination flags atomic [nf,v2] ipvs: make destination flags atomic - 1 - - --- 2026-07-08 Yizhou Zhao Needs Review / ACK
[net,v3] netfilter: nf_nat: recalculate TCP TS offset after SNAT port rewrite [net,v3] netfilter: nf_nat: recalculate TCP TS offset after SNAT port rewrite - 1 - - --- 2026-07-10 xietangxin New
[nf-next,v3] netfilter: ipset: skip extension destroy on hash resize replay [nf-next,v3] netfilter: ipset: skip extension destroy on hash resize replay - 1 - - --- 2026-07-13 Weiming Shi New
[net,v2] net: flow_offload: serialize driver callback lists [net,v2] net: flow_offload: serialize driver callback lists - 1 - - --- 2026-07-26 Weiming Shi New
[nf,1/1] ipvs: guard estimator enqueue until limits are set ipvs: guard estimator enqueue until limits are set - 1 - - --- 2026-07-27 Ren Wei New
[nf,1/1] netfilter: ebtables: avoid unbounded counter allocations netfilter: ebtables: avoid unbounded counter allocations - 1 - - --- 2026-07-27 Ren Wei New
ipvs: clear IPv4 options after rebasing tunnel ICMP errors ipvs: clear IPv4 options after rebasing tunnel ICMP errors - 1 - - --- 2026-07-31 David Lee New
[nf-next] netfilter: conntrack: sctp: validate vtag before state changes [nf-next] netfilter: conntrack: sctp: validate vtag before state changes - - - - --- 2026-07-31 Yizhou Zhao New
[net] netfilter: nf_dup_netdev: scrub duplicates to preserve the direct path [net] netfilter: nf_dup_netdev: scrub duplicates to preserve the direct path - - - - --- 2026-08-04 Alexandre Ferrieux New
selftests: netfilter: add functional test for nft ct timeout policies selftests: netfilter: add functional test for nft ct timeout policies - - - - --- 2026-08-05 Valery Borovsky New
netfilter: nf_conntrack: validate template helper protocol netfilter: nf_conntrack: validate template helper protocol - 1 - - --- 2026-08-10 Kyle Zeng Under Review
[nft,1/2] parser_json: fix CMD_OBJ/NFT_OBJECT mismatch in delete path parser_json: fix JSON delete of ct stateful objects - - - - --- 2026-08-11 Gergely Palotas New
[nft,2/2] tests: shell: add JSON delete test for ct stateful objects parser_json: fix JSON delete of ct stateful objects - - - - --- 2026-08-11 Gergely Palotas New
[1/4] lib/ts_bm: advance state->offset past the reported match lib/textsearch: fix ts_bm resume offset, add tests, two small cleanups - 1 - - --- 2026-08-16 Bernard Ladenthin Under Review
[2/4] lib/tests: add KUnit tests for the textsearch infrastructure lib/textsearch: fix ts_bm resume offset, add tests, two small cleanups - - - - --- 2026-08-16 Bernard Ladenthin Under Review
[3/4] textsearch: align ts_state.cb like skb->cb lib/textsearch: fix ts_bm resume offset, add tests, two small cleanups - - - - --- 2026-08-16 Bernard Ladenthin Under Review
[4/4] lib/ts_fsm: document that a match must consume the remaining data lib/textsearch: fix ts_bm resume offset, add tests, two small cleanups - - - - --- 2026-08-16 Bernard Ladenthin Under Review
[net] netfilter: ipset: list:set: defer ip_set_put_byindex to RCU callback [net] netfilter: ipset: list:set: defer ip_set_put_byindex to RCU callback - 1 - - --- 2026-08-20 Cen Zhang (Microsoft) New
netfilter: nf_conntrack: avoid truncating IPv6 nexthdr offset netfilter: nf_conntrack: avoid truncating IPv6 nexthdr offset - 1 - - --- 2026-08-22 Jérémy Jean New
[net,v2] netfilter: ipset: add synchronize_rcu() in destroy to close use-after-free race [net,v2] netfilter: ipset: add synchronize_rcu() in destroy to close use-after-free race - 1 - - --- 2026-08-25 Cen Zhang (Microsoft) New
[nf] netfilter: nf_tables: Fix netdev hook sanity checks [nf] netfilter: nf_tables: Fix netdev hook sanity checks - 1 - - --- 2026-08-27 Phil Sutter New
[RESEND,nf-next] netfilter: nf_conntrack_h323: fix double cursor advance in decode_int() [RESEND,nf-next] netfilter: nf_conntrack_h323: fix double cursor advance in decode_int() - 1 - - --- 2026-08-31 luoqing New
[nf-next,v2,1/2] netfilter: flowtable: carry a priority into the offload [nf-next,v2,1/2] netfilter: flowtable: carry a priority into the offload - - - - --- 2026-09-02 Julius Bairaktaris New
[nf-next,v2,2/2] selftests: netfilter: nft_flowtable.sh: check the priority a flow carries [nf-next,v2,1/2] netfilter: flowtable: carry a priority into the offload - - - - --- 2026-09-02 Julius Bairaktaris New
[nf,v3] netfilter: nft_payload: restrict checksum offsets to known values [nf,v3] netfilter: nft_payload: restrict checksum offsets to known values - 1 - - --- 2026-09-05 Florian Westphal New
netfilter: nf_conntrack_h323: fix OOB read in decode_enum() netfilter: nf_conntrack_h323: fix OOB read in decode_enum() - 1 - - --- 2026-09-07 Aamir Ahmed New
[nf,1/1] netfilter: xt_IDLETIMER: restrict to init_net netfilter: xt_IDLETIMER: restrict to init_net - 1 - - --- 2026-09-07 Zhiling Zou New
[nf] ipvs: fix more races around the overload flag [nf] ipvs: fix more races around the overload flag - 1 - - --- 2026-09-07 Julian Anastasov New
[nf-next,v3,8/8] netfilter: ipset: use GFP_KERNEL_ACCOUNT [nf-next,v3,1/8] netfilter: x_tables: use GFP_KERNEL_ACCOUNT in match/target - - - - --- 2026-09-07 Pablo Neira Ayuso New
[nf-next,3/4] netfilter: conntrack: nf_ct_seq_adjust to return error cause netfilter: Conntrack counter review - - - - --- 2026-09-08 Phil Sutter New
[nf-next,4/4] netfilter: conntrack: Improve invalid packet stats netfilter: Conntrack counter review - - - - --- 2026-09-08 Phil Sutter New
[nf] ipvs: read the seq_mask only once on sync [nf] ipvs: read the seq_mask only once on sync - 1 - - --- 2026-09-09 Julian Anastasov New
[nf-next,1/4] netfilter: conntrack: pick up a TCP flow whose SYN was never answered netfilter: offload a TCP flow whose reply is never seen - - - 1 --- 2026-09-10 Julius Bairaktaris New
[nf-next,2/4] netfilter: flowtable: promote a flow offloaded in one direction only netfilter: offload a TCP flow whose reply is never seen - - - - --- 2026-09-10 Julius Bairaktaris New
[nf-next,3/4] netfilter: nft_flow_offload: offload a TCP flow that has no reply netfilter: offload a TCP flow whose reply is never seen - - - - --- 2026-09-10 Julius Bairaktaris New
[nf-next,4/4] selftests: netfilter: cover a TCP flow whose reply is never seen netfilter: offload a TCP flow whose reply is never seen - - - - --- 2026-09-10 Julius Bairaktaris New
[net] netfilter: flowtable: Saturate 16-bit flow_tuple->mtu [net] netfilter: flowtable: Saturate 16-bit flow_tuple->mtu - 1 - - --- 2026-09-10 Alice Mikityanska New
selftests: netfilter: fix nft_audit.sh auditd detection selftests: netfilter: fix nft_audit.sh auditd detection - - - - --- 2026-09-11 Jin Li New
[nf-next] netfilter: conntrack: prevent nf_conntrack_buckets race condition [nf-next] netfilter: conntrack: prevent nf_conntrack_buckets race condition - 1 - - --- 2026-09-11 Fernando Fernandez Mancera New
[nft,v3] evaluate: reject negative values for unsigned datatypes [nft,v3] evaluate: reject negative values for unsigned datatypes - 1 - - --- 2026-09-11 Avinash Duduskar New
[nft] tests: shell: drop metainfo from the json dump comparison [nft] tests: shell: drop metainfo from the json dump comparison - - - - --- 2026-09-11 Avinash Duduskar New
[nf,1/1] ipvs: avoid stack overflow from recursive connection expiration ipvs: avoid stack overflow from recursive connection expiration - 1 - - --- 2026-09-12 zihan xi New
[net,1/1] ipvs: bound twos scheduler destination walks ipvs: bound twos scheduler destination walks - 1 - - --- 2026-09-12 Ren Wei New
[nf,v2,1/2] netfilter: flowtable: fill the vlan key from the outermost tag only netfilter: flowtable: correct and advertise the vlan match - 1 - - --- 2026-09-13 Julius Bairaktaris New
[nf,v2,2/2] netfilter: flowtable: advertise the vlan match in used_keys [nf] netfilter: flowtable: advertise the vlan match in used_keys - 1 - - --- 2026-09-13 Julius Bairaktaris New
[nf-next,v5,1/3] netfilter: flow: Add bridge_vid member flow offload teardown when layer 2 roaming - - - - --- 2026-09-14 Julius Bairaktaris New
[nf-next,v5,2/3] netfilter: flowtable: teardown direct xmit flows when the fdb entry moves flow offload teardown when layer 2 roaming - - - - --- 2026-09-14 Julius Bairaktaris New
[nf-next,v5,3/3] selftests: netfilter: nft_flowtable.sh: roam a host between two bridge ports flow offload teardown when layer 2 roaming - - - - --- 2026-09-14 Julius Bairaktaris New
[nf-next,v3,1/6] net: netfilter: nf_flow_table: recognize IPv4/IPv6 in tunnel proto matching net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nf-next,v3,2/6] net: netfilter: nf_flow_table: set inner protocol when popping tunnel header net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nf-next,v3,3/6] net: netfilter: nf_flow_table: populate tunnel tuple regardless of inner protocol net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nf-next,v3,4/6] net: netfilter: add encap_proto to flow_offload_tunnel net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nf-next,v3,5/6] net: netfilter: nf_flow_table: refactor MTU check for tunnel offload net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nf-next,v3,6/6] net: netfilter: nf_flow_table: unify tunnel push for IPv4 and IPv6 net: netfilter: preliminary support for IPv4 over IPv6 and SIT flowtable offload - - - - --- 2026-09-17 Lorenzo Bianconi New
[nft,1/2] doc: nft.8: Describe nftables transactions and their limitations [nft,1/2] doc: nft.8: Describe nftables transactions and their limitations - - - - --- 2026-09-17 Phil Sutter New
[nft,2/2] doc: nft.8: Document caveats when mixing clients [nft,1/2] doc: nft.8: Describe nftables transactions and their limitations - - - - --- 2026-09-17 Phil Sutter New
[nft] Fix for warnings when compiling for 32bit arch [nft] Fix for warnings when compiling for 32bit arch - - - - --- 2026-09-17 Phil Sutter New
[nf-next,v5] netfilter: ip6tables: hotdrop malformed hbh/dst and srh headers [nf-next,v5] netfilter: ip6tables: hotdrop malformed hbh/dst and srh headers - - - - --- 2026-09-18 Zhixing Chen New
[nf,1/1] netfilter: nf_ip6_checksum: validate checksum offset netfilter: nf_ip6_checksum: validate checksum offset - 2 - - --- 2026-09-18 Ren Wei New
[net,v2,0/8] Netfilter/IPVS fixes for net - - - - --- 2026-09-18 Pablo Neira Ayuso New
[v3,nf,1/6] netfilter: nf_conntrack: validate skb->_nfct and packet headers netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[v3,nf,2/6] netfilter: nf_conntrack: refactor helper call logic in nf_confirm() netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[v3,nf,3/6] netfilter: nf_conntrack: verify L4 protocol before calling helper netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[v3,nf,4/6] netfilter: conntrack: replace open-coded helper invocation netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[v3,nf,5/6] netfilter: nf_conntrack: harden helper invocation with tuple revalidation netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[v3,nf,6/6] netfilter: nft_ct: validate timeout object protocol netfilter: harden conntrack vs ingress pipeline rewrites - 1 - - --- 2026-09-18 Florian Westphal New
[nf-next] selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply [nf-next] selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply - - 1 - --- 2026-09-18 Jakub Kicinski New
« 1 2 3 »