The following patchset contains Netfilter fixes for *net*: 1) I managed to add a null dereference crash in nft_set_pipapo in the current development cycle, was not caught by CI because the avx2 implementation is fine, but selftest splats when run on non-avx2 host. 2) Fix the ipvs estimater kthread affinity, was incorrect since 6.14. From Frederic Weisbecker. 3) nf_tables should not allow to add a device to a flowtable or netdev chain more than once -- reject this. From Pablo Neira Ayuso. This has been broken for long time, blamed commit dates from v5.8. Please, pull these changes from: The following changes since commit d7e82594a45c5cb270940ac469846e8026c7db0f: selftests: tls: test TCP stealing data from under the TLS socket (2025-08-12 18:59:06 -0700) are available in the Git repository at: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git tags/nf-25-08-13 for you to fetch changes up to cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973: netfilter: nf_tables: reject duplicate device on updates (2025-08-13 08:34:55 +0200) ---------------------------------------------------------------- netfilter pull request nf-25-08-13 ---------------------------------------------------------------- Florian Westphal (1): netfilter: nft_set_pipapo: fix null deref for empty set Frederic Weisbecker (1): ipvs: Fix estimator kthreads preferred affinity Pablo Neira Ayuso (1): netfilter: nf_tables: reject duplicate device on updates include/net/ip_vs.h | 13 +++++++++++++ kernel/kthread.c | 1 + net/netfilter/ipvs/ip_vs_est.c | 3 ++- net/netfilter/nf_tables_api.c | 30 ++++++++++++++++++++++++++++++ net/netfilter/nft_set_pipapo.c | 5 ++--- 5 files changed, 48 insertions(+), 4 deletions(-) -- 2.49.1
