Package: linux-image-7.0.12+kali-amd64
Source package: linux
Version: 7.0.12-2kali1
Architecture: amd64
Product version: kali-dev

Summary

Kali rolling's amd64 kernel has CONFIG_NETFILTER_NETLINK_HOOK disabled and does not provide the nfnetlink_hook module. As a result, the documented nftables diagnostic command "nft list hooks" returns no entries even when an active nftables base chain is present. Normal ruleset listing still works.

This is a diagnostic/observability gap, not a claim that Kali's firewall is broken and not a security vulnerability.

Tested environment

Kali GNU/Linux Rolling, VERSION_ID=2026.3 development cycle
Kernel: 7.0.12+kali-amd64, package version 7.0.12-2kali1
nftables: 1.1.6
Architecture: amd64
Environment: isolated, networkless KVM guest using official Kali userspace, kernel, modules, and nftables packages

Steps to reproduce

1. Confirm the kernel configuration and module state:

   grep NETFILTER_NETLINK_HOOK /boot/config-$(uname -r)
   modinfo nfnetlink_hook

2. Run the following in an isolated network namespace:

   sudo unshare --net bash -c '
   set -eu
   nft add table inet kconfig_evidence
   trap "nft delete table inet kconfig_evidence 2>/dev/null || true" EXIT
   nft add chain inet kconfig_evidence input \
   "{ type filter hook input priority 0; policy accept; }"
   echo "--- ruleset ---"
   nft list ruleset
   echo "--- hooks ---"
   nft list hooks inet
   '

Observed behavior

The kernel configuration contains:

CONFIG_NETFILTER_NETLINK_HOOK is not set

modinfo reports:

modinfo: ERROR: Module nfnetlink_hook not found.

The temporary base chain is visible in "nft list ruleset":

table inet kconfig_evidence {
chain input {
type filter hook input priority filter; policy accept;
}
}

However, "nft list hooks inet" returns exit status 0 and produces exactly zero bytes of output. Setup and cleanup both return 0.

Expected behavior and scope

The nftables manual describes "list hooks" as showing registered functions and base chains. It explicitly states that this functionality requires CONFIG_NETFILTER_NETLINK_HOOK and that the module is named nfnetlink_hook:

https://netfilter.org/projects/nftables/manpage.html

I expected the temporary kconfig_evidence/input base chain to appear in "nft list hooks inet". The command is useful for diagnosing hook ordering among nftables base chains and kernel components such as conntrack and NAT. This report is limited to that diagnostic interface; ordinary nftables ruleset creation and listing work in the same guest.

Configuration context

Kali rolling 7.0.12 and the checked previous Kali snapshot both set CONFIG_NETFILTER_NETLINK_HOOK=n, so this does not look like a one-build regression. The checked current Debian, Fedora, Arch Linux, and openSUSE kernels build this feature as a module. This cross-distribution comparison is discovery context, not proof that Kali must use the same policy.

Kali already enables:

CONFIG_NETFILTER_ADVANCED=y
CONFIG_NETFILTER_NETLINK=m
CONFIG_NF_TABLES=m

Requested action

Could the Kali kernel maintainers please confirm whether disabling CONFIG_NETFILTER_NETLINK_HOOK is intentional? If there is no conflicting Kali policy, please consider building it as a module so that the documented "nft list hooks" diagnostic works. If keeping it disabled is intentional, documenting that limitation would also resolve the policy question.

Thank you for reviewing this.

hppiscas