| Published | Title | Version | Author | Status |
|---|---|---|---|---|
| 2026-11-13 12:13 UTC | ipvs: pass correct sk to update_pmtu and on tunneling | 4 | ja@ssi.bg | - |
| 2026-11-13 03:12 UTC | Netfilter updates for net-next | 1 | pablo@netfilter.org | - |
| 2026-11-13 01:14 UTC | IPVS fixes for net | 1 | pablo@netfilter.org | - |
| 2026-11-12 20:40 UTC | net: drop the stale dst when steering to another device | 2 | jhs@mojatatu.com | - |
| 2026-11-12 14:38 UTC | ipset: replace internal hash table with rhashtable | 10 | fw@strlen.de | - |
| 2026-11-12 14:14 UTC | netfilter: nfnetlink_queue: use verdict sender portid for expectation events | 1 | pocj8ur4in@gmail.com | - |
| 2026-11-12 06:29 UTC | ipvs: drop the packets with port 0 | 1 | ja@ssi.bg | - |
| 2026-11-12 00:33 UTC | ipset: replace internal hash table with rhashtable | 9 | fw@strlen.de | - |
| 2026-11-11 20:09 UTC | ipvs: pass correct sk to update_pmtu and on tunneling | 3 | ja@ssi.bg | - |
| 2026-11-11 17:01 UTC | Fix two leaks in error path, one extra | 1 | phil@nwl.cc | - |
| 2026-11-11 15:30 UTC | include: libmnl.h: Add explicit casts to macros for C++ | 1 | phil@nwl.cc | - |
| 2026-11-11 14:16 UTC | net: drop the stale dst when steering to another device | 1 | jhs@mojatatu.com | - |
| 2026-11-11 11:12 UTC | netfilter: nf_tables: speed up loading rulesets with many sets | 1 | s.hanreich@proxmox.com | - |
| 2026-11-11 10:16 UTC | tests: hash:net,iface: cover cross-iface narrow-net fallthrough blocking | 1 | fw@strlen.de | - |
| 2026-11-11 10:11 UTC | ipset: replace internal hash table with rhashtable | 8 | fw@strlen.de | - |
| 2026-11-11 08:44 UTC | netfilter: nf_nat: skip the xfrm re-lookup without outbound policies | 1 | antonio@mandelbit.com | - |
| 2026-11-11 00:31 UTC | netfilter: don't send decrypted skbs in clear text | 1 | toddfreed@meta.com | in progress |
| 2026-11-10 13:34 UTC | netfilter: nf_conntrack: limit expectation master chain depth | 2 | fw@strlen.de | finished in 4h42m0s |
| 2026-11-10 13:16 UTC | ipv6: honor rule suppression in raw FIB lookups | 1 | leonard@lausen.nl | finished in 4h59m0s |
| 2026-11-10 11:35 UTC | audit: fix incomplete NETFILTER_PKT records and return void | 1 | jiangjiehua1@huawei.com | finished in 5h14m0s |
| 2026-11-10 02:18 UTC | netfilter: conntrack: attach generated TCP resets as ESTABLISHED | 2 | xujiahao@cmss.chinamobile.com | finished in 4h33m0s |
| 2026-11-09 21:58 UTC | extensions: ebt_string: Fix --string-icase using ebt_check_inverse | 2 | yupeng@kylinos.cn | skipped |
| 2026-11-09 21:58 UTC | extensions: ebt_string: Fix --string-icase using ebt_check_inverse | 2 | yupeng@kylinos.cn | skipped |
| 2026-11-09 21:58 UTC | extensions: ebt_string: Fix --string-icase using ebt_check_inverse | 2 | yupeng@kylinos.cn | skipped |
| 2026-11-09 21:57 UTC | extensions: ebt_string: Fix --string-icase using ebt_check_inverse | 2 | yupeng@kylinos.cn | skipped |
| 2026-11-09 19:18 UTC | netfilter: bridge: refragment packets with a vlan tag moved by the bridge | 1 | laveeshb@laveeshbansal.com | finished in 2h39m0s |
| 2026-11-09 16:47 UTC | netfilter: nf_reject: validate TCP header length before sending resets | 2 | zhangmh25@mails.tsinghua.edu.cn | finished in 4h46m0s |
| 2026-11-09 13:51 UTC | selftests: netfilter: add UDP flowtable offload test | 1 | jpeska@redhat.com | skipped |
| 2026-11-09 11:02 UTC | netfilter: nf_tables: add NFT_HOOK_UNREGISTERED and use it | 1 | pablo@netfilter.org | finished in 4h37m0s |
| 2026-11-09 09:31 UTC | netfilter: nf_socket: avoid UDP socket refcounting in socket match | 1 | devnull@kernel.org | finished in 3h53m0s |
| 2026-11-09 05:53 UTC | netfilter: conntrack: avoid secs-to-jiffies overflow in SIP helper | 3 | l1138897701@163.com | finished in 4h14m0s |
| 2026-11-09 02:52 UTC | net: annotate data-races around sysctl knobs | 1 | jiayuan.chen@linux.dev | finished in 4h11m0s |
| 2026-11-09 02:06 UTC | ipvs: wait grace period before reusing destinations | 3 | weir@nebusec.ai | finished in 4h39m0s |
| 2026-11-08 22:33 UTC | netfilter: nft_set_pipapo_avx2: bound refill rule index | 1 | noahweinberger2003@proton.me | finished in 4h44m0s |
| 2026-11-08 22:33 UTC | netfilter: ip_tables: propagate compat_table_info() error | 1 | noahweinberger2003@proton.me | finished in 4h37m0s |
| 2026-11-08 22:32 UTC | netfilter: nft_dynset: reject DELETE op when set lacks ->delete | 1 | noahweinberger2003@proton.me | finished in 4h9m0s |
| 2026-11-08 15:53 UTC | netfilter: flowtable: tear down bridged flows on layer 2 roaming | 9 | julius@bairaktaris.de | finished in 3h59m0s |
| 2026-11-07 19:44 UTC | netfilter: br_netfilter: reject unsafe neighbour devices for DNAT | 2 | kylebot@openai.com | finished in 3h51m0s |
| 2026-11-07 16:34 UTC | netfilter: nfnetlink_queue: make skb writable before writing NFQA_L2HDR | 2 | ty@000ty.net | finished in 4h14m0s |
| 2026-11-07 16:05 UTC | netfilter: nfnetlink_queue: unclone skb before writing NFQA_L2HDR | 1 | ty@000ty.net | finished in 4h31m0s |
| 2026-11-07 16:03 UTC | netfilter: nft_inner: always save the parsed tunnel context | 1 | ty@000ty.net | finished in 4h18m0s |
| 2026-11-06 19:18 UTC | libmnl: fix memory safety issues found by static analysis | 1 | florian.stosse@harvester.fr | skipped |
| 2026-11-06 15:38 UTC | ipset: replace internal hash table with rhashtable | 7 | fw@strlen.de | finished in 4h39m0s |
| 2026-11-06 14:30 UTC | netfilter: conntrack: document sparse hash table eviction | 2 | thisisforspotifyvikash@gmail.com | skipped |
| 2026-11-06 13:58 UTC | netfilter: conntrack: document sparse hash table eviction | 1 | thisisforspotifyvikash@gmail.com | skipped |
| 2026-11-06 06:56 UTC | netfilter: xt_nat: allow IP_CT_RELATED_REPLY in DNAT targets | 1 | xujiahao@cmss.chinamobile.com | finished in 4h9m0s |
| 2026-11-06 06:09 UTC | netfilter: conntrack: avoid secs-to-jiffies overflow in SIP helper | 2 | l1138897701@163.com | finished in 4h4m0s |
| 2026-11-06 00:37 UTC | netfilter: nfnetlink_queue: handle packet ID reuse and large gaps | 1 | devnull@kernel.org | finished in 3h51m0s |
| 2026-11-05 23:15 UTC | ipvs: do not create conns from packets with port 0 | 3 | ja@ssi.bg | finished in 4h6m0s |
| 2026-11-05 17:58 UTC | tests: hash:net,iface.t: check wildcard refresh ordering | 1 | fw@strlen.de | skipped |
| 2026-11-05 17:37 UTC | Fix for exclusive start cond corner cases | 1 | phil@nwl.cc | skipped |
| 2026-11-05 14:23 UTC | selftests: netfilter: add ipset flush vs. concurrent insert perf test | 1 | fw@strlen.de | skipped |
| 2026-11-05 13:25 UTC | datatype: resolve the root cgroupv2 path when listing elements | 1 | devnull@kernel.org | skipped |
| 2026-11-05 11:48 UTC | netfilter: nf_tables: fix pernet use-after-free on UNREGISTER rebroadcast | 1 | bsdhenrymartin@gmail.com | finished in 4h8m0s |
| 2026-11-05 11:34 UTC | netfilter: flowtable: do not clear the offload bit twice | 2 | devnull@kernel.org | finished in 3h52m0s |
| 2026-11-05 08:17 UTC | netfilter: xt_dccp: reject short option lengths | 1 | shawnq1@163.com | finished in 4h10m0s |
| 2026-11-05 06:55 UTC | netfilter: nf_flow_table: defer pernet stats release to last flowtable teardown | 1 | q.h.hack.winter@gmail.com | finished in 4h26m0s |
| 2026-11-04 20:15 UTC | ipvs: do not create conns from packets with port 0 | 2 | ja@ssi.bg | finished in 4h28m0s |
| 2026-11-04 10:58 UTC | tests: hash:net,iface.t: check wildcard add and delete | 1 | fw@strlen.de | skipped |
| 2026-11-04 08:59 UTC | netfilter: conntrack: avoid secs-to-jiffies overflow in SIP helper | 1 | l1138897701@163.com | finished in 4h27m0s |
| 2026-11-04 03:34 UTC | extensions: ebt_string: Fix --string-icase using ebt_check_inverse | 2 | yupeng@kylinos.cn | skipped |
| 2026-11-03 22:22 UTC | netfilter: flowtable: remove hw flows before unbinding the flow block | 1 | vallsfustearnau@gmail.com | finished in 3h53m0s |
| 2026-11-03 21:34 UTC | netfilter: flowtable: tunnel device poisons h_source of fast-path frames | 1 | marek@lysk.ai | finished in 1h57m0s |
| 2026-11-03 16:57 UTC | ipvs: keep templates and cport 0 conns away from packet lookups | 2 | axel.mierczuk@1password.com | finished in 4h44m0s |
| 2026-11-03 16:57 UTC | netfilter: nfnetlink_queue: keep socket ownership when expanding skb | 2 | fmancera@suse.de | finished in 4h52m0s |
| 2026-11-03 16:15 UTC | ipvs: reject negative sync_refresh_period values | 2 | 1075151112@qq.com | finished in 4h42m0s |
| 2026-11-03 15:25 UTC | ipvs: pass correct sk to update_pmtu and on tunneling | 2 | ja@ssi.bg | finished in 4h40m0s |
| 2026-11-03 14:02 UTC | netfilter: flowtable: do not scrub as crossing netns | 1 | pablo@netfilter.org | finished in 4h59m0s |
| 2026-11-03 14:00 UTC | Add IPv4 over IPv6 and SIT flowtable SW acceleration | 3 | lorenzo.bianconi@oss.qualcomm.com | finished in 4h48m0s |
| 2026-11-03 13:18 UTC | netfilter: nf_conntrack: limit expectation master chain depth | 2 | fw@strlen.de | finished in 5h15m0s |
| 2026-11-03 12:56 UTC | netfilter: synproxy: prevent unbounded recursion in transmit path | 1 | fmancera@suse.de |
finished
in 2h9m0s
[1 findings] |
| 2026-11-03 12:10 UTC | tests: hash:net,iface.t: check wildcard and nomatch ordering | 1 | fw@strlen.de | skipped |
| 2026-11-03 09:52 UTC | netfilter: flowtable: do not clear the offload bit twice | 1 | devnull@kernel.org | finished in 5h0m0s |
| 2026-11-03 07:12 UTC | ebtablesu: add O_NOFOLLOW to prevent symlink attack | 1 | 1041320071@qq.com | skipped |
| 2026-11-03 00:11 UTC | netfilter: flowtable: do not scrub as crossing netns | 1 | pablo@netfilter.org | finished in 4h26m0s |
| 2026-11-02 15:56 UTC | netfilter: nf_reject: validate TCP header length before sending resets | 1 | zhangmh25@mails.tsinghua.edu.cn | finished in 4h52m0s |
| 2026-11-02 09:39 UTC | ipvs: reject negative sync_refresh_period values | 1 | 1075151112@qq.com | finished in 3h57m0s |
| 2026-11-02 08:28 UTC | ipvs: honor the overload state and do not enter it forever | 1 | ja@ssi.bg | finished in 4h2m0s |
| 2026-11-02 08:21 UTC | ipvs: pass correct sk to update_pmtu and on tunneling | 1 | ja@ssi.bg | skipped |
| 2026-11-02 08:07 UTC | ipvs: read conn fields during sync atomically | 3 | ja@ssi.bg | finished in 4h22m0s |
| 2026-11-02 00:56 UTC | Netfilter/IPVS fixes for net | 1 | pablo@netfilter.org | finished in 4h34m0s |
| 2026-11-01 22:39 UTC | netfilter: nft_ct: reject expectation if conntrack has a master | 1 | pablo@netfilter.org | finished in 4h28m0s |
| 2026-11-01 22:36 UTC | netfilter: nft_ct: reject expectation if conntrack is a expect child | 1 | pablo@netfilter.org | finished in 4h13m0s |
| 2026-11-01 20:37 UTC | netfilter: ip6t_NPT: improve NPTv6 implementation for gateway usage scenario | 1 | n.merinov@inango-systems.com | finished in 4h39m0s |
| 2026-11-01 19:01 UTC | Add IPv4 over IPv6 and SIT flowtable SW acceleration | 2 | lorenzo.bianconi@oss.qualcomm.com | finished in 3h55m0s |
| 2026-11-01 17:06 UTC | netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly | 2 | ryosuke@ikotaslabs.com | finished in 4h27m0s |
| 2026-11-01 08:17 UTC | lib/ts_fsm: preserve patterns across tc dump and restore | 2 | zhiqizhangg@gmail.com | finished in 4h8m0s |
| 2026-11-01 06:15 UTC | ipvs: avoid wrapping persistent service timeouts | 2 | x-professor@outlook.com | finished in 3h51m0s |
| 2026-11-01 01:45 UTC | netfilter: nf_conntrack_reasm: restore IPv6 nhoff after reassembly | 1 | ryosuke@ikotaslabs.com | skipped |
| 2026-10-31 15:54 UTC | netfilter: nft_set_rbtree: do not pair an expired start with another interval's end | 1 | devnull@kernel.org | finished in 4h12m0s |
| 2026-10-31 11:44 UTC | netfilter: cthelper: report absent filtered deletes | 1 | pocj8ur4in@gmail.com | finished in 4h29m0s |
| 2026-10-31 07:15 UTC | ipvs: avoid wrapping persistent service timeouts | 1 | x-professor@outlook.com | finished in 3h49m0s |
| 2026-10-30 15:44 UTC | netfilter: logging cleanups | 1 | fw@strlen.de | finished in 4h11m0s |
| 2026-10-30 13:57 UTC | netfilter: nfnetlink_queue: keep socket ownership when expanding skb | 1 | fmancera@suse.de | finished in 4h3m0s |
| 2026-10-30 09:38 UTC | include/linux/jhash.h: fix kernel-doc parameter name | 1 | zhangcoder@yeah.net | skipped |
| 2026-10-30 04:21 UTC | netfilter: br_netfilter: reject unsafe neighbour devices for DNAT | 1 | kylebot@openai.com | finished in 3h52m0s |
| 2026-10-29 22:01 UTC | netfilter: nft_flow_offload: do not offload multicast | 2 | koralilgun@gmail.com | finished in 3h51m0s |
| 2026-10-29 17:32 UTC | netfilter: lwtunnel: expose read-only sysctl nf_hooks_lwtunnel for non init-netns | 1 | pablo@netfilter.org | finished in 4h43m0s |
| 2026-10-29 17:19 UTC | netfilter: flowtable: purge entries immediately when destroying the flowtable | 1 | pablo@netfilter.org |
finished
in 4h10m0s
[2 findings] |
| 2026-10-29 16:54 UTC | netfilter: nat: zero newrange before filling it in | 1 | fw@strlen.de | finished in 4h6m0s |