Kali CONFIG_NETFILTER_NETLINK_HOOK runtime evidence
===================================================

Collected: 2026-07-10 UTC
Environment: isolated, networkless KVM guest using official Kali rolling
userspace, kernel, modules, and nftables packages
Architecture: amd64
Kali VERSION_ID: 2026.3 development cycle
Kernel: 7.0.12+kali-amd64, package version 7.0.12-2kali1
nftables: 1.1.6

Kernel configuration
--------------------

CONFIG_NETFILTER_ADVANCED=y
CONFIG_NETFILTER_NETLINK=m
# CONFIG_NETFILTER_NETLINK_HOOK is not set
CONFIG_NF_TABLES=m

Module availability
-------------------

$ modinfo nfnetlink_hook
modinfo: ERROR: Module nfnetlink_hook not found.

Runtime comparison
------------------

An empty accept-policy base chain was created in a disposable network
namespace. Setup returned exit status 0.

$ nft list ruleset
table inet kconfig_evidence {
	chain input {
		type filter hook input priority filter; policy accept;
	}
}

$ nft list hooks inet
[no output]

The hook-list command returned exit status 0 but wrote exactly zero bytes.
The temporary table was then deleted successfully. This demonstrates a
missing hook-dump diagnostic, not a failure of the normal nftables filtering
path and not a security vulnerability.

Primary documentation
---------------------

The nftables manual documents "list hooks" and states that it requires
CONFIG_NETFILTER_NETLINK_HOOK, whose module is named nfnetlink_hook:
https://netfilter.org/projects/nftables/manpage.html