Re: nftables set/map operations failing in user namespace with Linux 7.1.6

Julius Rüberg <[email protected]> wrote:
> I'm reaching out because I'm encountering an issue with nftables using set/map
> operations (e.g., ip6 daddr set ip6 daddr map @forwardmap) inside user namespaces,
> introduced somewhere between Linux 7.0.12 and 7.1.3.
> I don't encounter the issue on the LTS Kernel (6.18.43).
> 
> If this is now intentionally restricted,

Yes:

commit 968cc2c96390f06e56ed6a43f935bfebdefed28f
Author: Florian Westphal <[email protected]>
Date:   Sat May 16 23:23:21 2026 +0800

    netfilter: disable payload mangling in userns

We should be able to lift that restriction in the coming weeks,
after stricter offset/length validation is in place.