nftables compatibility metadata is used to select an xt_CT helper when the conntrack template is created, but it does not constrain the protocol of packets evaluated by the rule. A template can therefore carry a helper for one transport protocol into a conntrack for another. Only copy a helper from a template when its registered transport protocol matches the new conntrack tuple. This restores the invariant expected by helper callbacks and matches the protocol validation already performed by native nftables helper assignment and the OVS helper path. Fixes: 0ca743a55991 ("netfilter: nf_tables: add compatibility layer for x_tables") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Kyle Zeng --- net/netfilter/nf_conntrack_helper.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 500509b17..419af6f76 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -205,6 +205,8 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl, help = nfct_help(tmpl); if (help) helper = rcu_dereference(help->helper); + if (helper && helper->tuple.dst.protonum != nf_ct_protonum(ct)) + helper = NULL; help = nfct_help(ct); -- 2.53.0