Re: [PATCH nf] netfilter: nft_payload: restrict checksum offsets to known values

Florian Westphal <[email protected]> wrote:
> We need to prevent userspace from corrupting e.g. tcp->doff, because
> many locations in conntrack and conntrack helpers rely on
> nf_conntrack_in() having validated the packet headers.
> nft_payload allows to alter headers later which invalidates this
> assumption.

https://sashiko.dev/#/patchset/20260824192843.28439-1-fw%40strlen.de

Can't make sense of it, afaics this patch is fine.