From: Dong Chenchen <dongchenchen2@huawei.com> This series adapts the CVE-2026-64078 netfilter x_tables fixes to OLK-6.6. It contains the first 5 patches from the upstream v3 series sent to netfilter-devel, re-targeted to the OLK-6.6 codebase. Bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16470 CVE: CVE-2026-64078 Florian Westphal (4): netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: xtables: allocate hook ops while under mutex netfilter: x_tables: add and use xt_unregister_table_pre_exit netfilter: x_tables: add and use xtables_unregister_table_exit include/linux/netfilter/x_tables.h | 4 +- include/linux/netfilter_arp/arp_tables.h | 1 - include/linux/netfilter_ipv4/ip_tables.h | 1 - include/linux/netfilter_ipv6/ip6_tables.h | 1 - net/ipv4/netfilter/arp_tables.c | 53 +------ net/ipv4/netfilter/arptable_filter.c | 2 +- net/ipv4/netfilter/ip_tables.c | 59 +------- net/ipv4/netfilter/iptable_filter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/iptable_nat.c | 6 +- net/ipv4/netfilter/iptable_raw.c | 2 +- net/ipv4/netfilter/iptable_security.c | 2 +- net/ipv6/netfilter/ip6_tables.c | 56 +------ net/ipv6/netfilter/ip6table_filter.c | 2 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/ip6table_nat.c | 6 +- net/ipv6/netfilter/ip6table_raw.c | 2 +- net/ipv6/netfilter/ip6table_security.c | 2 +- net/netfilter/x_tables.c | 177 ++++++++++++++++++---- 19 files changed, 193 insertions(+), 189 deletions(-) -- 2.43.0