Backported two other patches in order for the fix to apply cleanly.

Signed-off-by: Miguel Gazquez (Schneider Electric) <miguel.gazquez@bootlin.com>
---
Pablo Neira Ayuso (3):
      netfilter: nf_conntrack_pptp: move GRE specific cleanup to GRE tracker
      netfilter: conntrack: check NULL when retrieving ct extension
      netfilter: nf_conntrack_expect: use conntrack GC to reap expectations

 include/net/netfilter/ipv4/nf_conntrack_ipv4.h     |   4 +
 include/net/netfilter/nf_conntrack_expect.h        |  16 +-
 include/net/netfilter/nf_conntrack_helper.h        |   2 +
 include/uapi/linux/netfilter/nf_conntrack_common.h |   1 +
 net/ipv4/netfilter/nf_nat_h323.c                   |  12 ++
 net/ipv4/netfilter/nf_nat_pptp.c                   |  14 +-
 net/netfilter/nf_conntrack_broadcast.c             |   3 +
 net/netfilter/nf_conntrack_core.c                  |  33 +++-
 net/netfilter/nf_conntrack_expect.c                | 174 ++++++++++-----------
 net/netfilter/nf_conntrack_ftp.c                   |   6 +
 net/netfilter/nf_conntrack_h323_main.c             |  22 ++-
 net/netfilter/nf_conntrack_helper.c                |  10 +-
 net/netfilter/nf_conntrack_netlink.c               |  22 ++-
 net/netfilter/nf_conntrack_pptp.c                  |  72 ++-------
 net/netfilter/nf_conntrack_proto_gre.c             |  71 +++++++++
 net/netfilter/nf_conntrack_sane.c                  |   3 +
 net/netfilter/nf_conntrack_seqadj.c                |  17 +-
 net/netfilter/nf_conntrack_sip.c                   |  54 +++++--
 net/netfilter/nf_nat_sip.c                         |  12 ++
 net/netfilter/nfnetlink_cthelper.c                 |   6 +
 net/netfilter/nft_ct.c                             |   3 +-
 21 files changed, 363 insertions(+), 194 deletions(-)
---
base-commit: fa5b06866b643cce7072a4e7c6be7ee3f0f1b95c
change-id: 20260918-cve-2026-80668-v2-ca59f0cceb99

Best regards,
--  
Miguel Gazquez (Schneider Electric) <miguel.gazquez@bootlin.com>

> Backported two other patches in order for the fix to apply cleanly.

Thanks for splitting this per tree, but could you respin? This applies to the
6.6.y and 6.1.y postings too.

6.18.y carries the bug and has no series, so all three are blocked behind it.
Your 6.12 patches 1/3 and 2/3 apply to 6.18 unchanged, and 3/3 fails only three
hunks, all because 6.18 spells timer_delete() and timer_container_of() where
6.12 has del_timer() and from_timer(), on
deleted lines only.

Patch 3/3 has no "[ Upstream commit b8b09dc2bf35a00d4e0556b5d6308c7b917ebda2 ]"
line, so the CVE fix would land with no upstream reference.

Patches 2/3 and 3/3 carry no Signed-off-by from you.

In 2/3 the new "return false" in nf_ct_gre_keymap_add() is wrong here:
the function returns int on these trees, where 0 is success, so the
error path reports success. It needs a negative errno.

The series is missing 4aa63842fc92 ("netfilter: nf_conntrack_expect: add
and use nf_ct_expect_related_pair()"), Fixes: b8b09dc2bf35, already in
7.1.y and 7.2. Without it the SIP and H.323 helpers re-insert
expectations they have just unexpected.

The Stable-dep-of: 979c13114c0b trailer on 1/3 and 2/3 names a commit
the series never applies.

-- 
Thanks,
Sasha