Upstream commit to backport:

commit 545edb7a8ef0a8acf991b1b7857fddc24d7b151a
Author: Phil Sutter <phil>
Date:   Wed Sep 28 23:26:42 2022 +0200

    monitor: Sanitize startup race condition
    
    During startup, 'nft monitor' first fetches the current ruleset and then
    keeps this cache up to date based on received events. This is racey, as
    any ruleset changes in between the initial fetch and the socket opening
    are not recognized.
    
    This script demonstrates the problem:
    
    | #!/bin/bash
    |
    | while true; do
    |       nft flush ruleset
    |       iptables-nft -A FORWARD
    | done &
    | maniploop=$!
    |
    | trap "kill $maniploop; kill \$!; wait" EXIT
    |
    | while true; do
    |       nft monitor rules >/dev/null &
    |       sleep 0.2
    |       kill $!
    | done
    
    If the table add event is missed, the rule add event callback fails to
    deserialize the rule and calls abort().
    
    Avoid the inconvenient program exit by returning NULL from
    netlink_delinearize_rule() instead of aborting and make callers check
    the return value.
    
    Signed-off-by: Phil Sutter <phil>

Jiri, please ACK for RHEL9.1.z.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (nftables bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:0950