Patrick McHardy wrote:
> Thanks, that answers my question. I'll apply your patch and send it to
> -stable once its in the mainline kernel.

The same bug was also present in ip6_tables and arp_tables.
This is the patch I've committed: