From: Dong Chenchen <dongchenchen2@huawei.com> This series backports the upstream fix for CVE-2026-64079 to OLK-6.6. Patch 1 is the prerequisite that defers the audit register log message until after hooks are wired up. Patch 2 moves hook ops allocation into the xtables core so the table is never visible in the per-netns list with ops=NULL, preventing a NULL dereference during concurrent netns tear-down. The main CVE patch adapts kmemdup_array() to kmemdup(), because kmemdup_array() is not available in OLK-6.6. bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16469 Florian Westphal (2): netfilter: x_tables: allow initial table replace without emitting audit log message netfilter: x_tables: allocate hook ops while under mutex include/linux/netfilter/x_tables.h | 1 + net/ipv4/netfilter/arp_tables.c | 35 ++------------ net/ipv4/netfilter/ip_tables.c | 41 ++-------------- net/ipv6/netfilter/ip6_tables.c | 38 ++------------- net/netfilter/x_tables.c | 77 +++++++++++++++++++++++------- 5 files changed, 74 insertions(+), 118 deletions(-) -- 2.43.0