Incomplete nftables backport leaves UAF in Linux stable kernels

Linux stable kernels in the 6.6.y line (and older) still carry use-after-free and double-free flaws in the nftables pipapo set implementation after an incomplete backport of an on-demand-clone series.

Fahad Alharbi reported that 6.6.148 pulled in the main pipapo on-demand-clone work but left out two companion changes from Florian Westphal's 2024 series: one that prepares the destroy path for on-demand clones, and one that removes a dirty flag. Both landed in 6.10 and later, and both are present in mainline. Without them, a garbage-collection batch can be left stranded, producing the UAF and double-free conditions.

Greg Kroah-Hartman replied that the missing patches do not apply cleanly to the older trees and asked for working backports so they can be queued. Until those land, affected stable kernels remain exposed in the netfilter set code that handles pipapo lookups.