Subject: Re: [PATCH net] netfilter: nf_flow_table_offload: fix heap overflow in flow_action_entry_next()

From: Pablo Neira Ayuso <[email-masked]>
Date: Thu, 26 Mar 2026 22:32:50 +0100

On Sun, Mar 08, 2026 at 02:23:06AM +0900, Hyunwoo Kim wrote:
> flow_action_entry_next() increments num_entries and returns a pointer
> into the flow_action_entry array without any bounds checking.  The array
> is allocated with a fixed size of NF_FLOW_RULE_ACTION_MAX (16) entries,
> but certain combinations of IPv6 + SNAT + DNAT + double VLAN (QinQ)
> require 17 or more entries, causing a slab-out-of-bounds write in the
> kmalloc-4k slab.
> 
> The maximum possible entry count is:
>   tunnel(2) + eth(4) + VLAN(4) + IPv6_NAT(10) + redirect(1) = 21
> 
> Increase NF_FLOW_RULE_ACTION_MAX to 24 (with headroom) to cover the
> worst case.

For the record, proposed patch:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/[email-masked]/