diff --git a/package/network/utils/iproute2/Makefile b/package/network/utils/iproute2/Makefile
index 2f9d2f2bc98110..9ad1d9636408ad 100644
--- a/package/network/utils/iproute2/Makefile
+++ b/package/network/utils/iproute2/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=iproute2
-PKG_VERSION:=6.7.0
+PKG_VERSION:=6.8.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/net/iproute2
-PKG_HASH:=ff942dd9828d7d1f867f61fe72ce433078c31e5d8e4a78e20f02cb5892e8841d
+PKG_HASH:=03a6cca3d71a908d1f15f7b495be2b8fe851f941458dc4664900d7f45fcf68ce
 PKG_BUILD_PARALLEL:=1
 PKG_BUILD_DEPENDS:=iptables
 PKG_LICENSE:=GPL-2.0
@@ -77,14 +77,7 @@ $(call Package/iproute2/Default)
   VARIANT:=tcfull
   PROVIDES:=tc
   ALTERNATIVES:=400:/sbin/tc:/usr/libexec/tc-full
-  DEPENDS:=+kmod-sched-core +(PACKAGE_devlink||PACKAGE_rdma):libmnl +libbpf +libxtables +tc-mod-iptables
-endef
-
-define Package/tc-mod-iptables
-$(call Package/iproute2/Default)
-  TITLE:=Traffic control module - iptables action
-  VARIANT:=tcfull
-  DEPENDS:=+libxtables +libbpf
+  DEPENDS:=+kmod-sched-core +(PACKAGE_devlink||PACKAGE_rdma):libmnl +libbpf +libxtables
 endef
 
 define Package/genl
@@ -232,11 +225,6 @@ define Package/tc-full/install
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/tc/tc $(1)/usr/libexec/tc-full
 endef
 
-define Package/tc-mod-iptables/install
-	$(INSTALL_DIR) $(1)/usr/lib/tc
-	$(CP) $(PKG_BUILD_DIR)/tc/m_xt.so $(1)/usr/lib/tc
-endef
-
 define Package/genl/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/genl/genl $(1)/usr/sbin/
@@ -269,9 +257,6 @@ endef
 
 $(eval $(call BuildPackage,ip-tiny))
 $(eval $(call BuildPackage,ip-full))
-# build tc-mod-iptables before its dependents, to avoid
-# spurious rebuilds when building multiple variants.
-$(eval $(call BuildPackage,tc-mod-iptables))
 $(eval $(call BuildPackage,tc-tiny))
 $(eval $(call BuildPackage,tc-bpf))
 $(eval $(call BuildPackage,tc-full))
diff --git a/package/network/utils/iproute2/patches/001-fix-build.patch b/package/network/utils/iproute2/patches/001-fix-build.patch
new file mode 100644
index 00000000000000..964b7a65abb532
--- /dev/null
+++ b/package/network/utils/iproute2/patches/001-fix-build.patch
@@ -0,0 +1,25 @@
+Index: iproute2-6.8.0/bridge/mdb.c
+===================================================================
+--- iproute2-6.8.0.orig/bridge/mdb.c
++++ iproute2-6.8.0/bridge/mdb.c
+@@ -7,6 +7,7 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <fcntl.h>
++#include <limits.h>
+ #include <sys/socket.h>
+ #include <net/if.h>
+ #include <netinet/in.h>
+Index: iproute2-6.8.0/include/json_print.h
+===================================================================
+--- iproute2-6.8.0.orig/include/json_print.h
++++ iproute2-6.8.0/include/json_print.h
+@@ -8,6 +8,8 @@
+ #ifndef _JSON_PRINT_H_
+ #define _JSON_PRINT_H_
+ 
++#include <sys/time.h>
++
+ #include "json_writer.h"
+ #include "color.h"
+ 
diff --git a/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch b/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
index c32863c3648997..38448e6cd6f920 100644
--- a/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
+++ b/package/network/utils/iproute2/patches/115-add-config-xtlibdir.patch
@@ -1,6 +1,6 @@
 --- a/tc/Makefile
 +++ b/tc/Makefile
-@@ -119,6 +119,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
+@@ -107,6 +107,9 @@ CFLAGS += -DCONFIG_GACT -DCONFIG_GACT_PR
  ifneq ($(IPT_LIB_DIR),)
  	CFLAGS += -DIPT_LIB_DIR=\"$(IPT_LIB_DIR)\"
  endif
diff --git a/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch b/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
index 0d228757517fa7..ee18f17d54f00e 100644
--- a/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
+++ b/package/network/utils/iproute2/patches/140-keep_libmnl_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -391,7 +391,7 @@ check_tirpc()
+@@ -362,7 +362,7 @@ check_tirpc()
  
  check_mnl()
  {
diff --git a/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch b/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
index bffacddb21738d..99b9d326fe4f8b 100644
--- a/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
+++ b/package/network/utils/iproute2/patches/145-keep_libelf_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -246,7 +246,7 @@ EOF
+@@ -217,7 +217,7 @@ EOF
  
  check_elf()
  {
diff --git a/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch b/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
index 570e9c7038bc27..767c968e74c289 100644
--- a/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
+++ b/package/network/utils/iproute2/patches/150-keep_libcap_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -449,7 +449,7 @@ EOF
+@@ -421,7 +421,7 @@ EOF
  
  check_cap()
  {
diff --git a/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch b/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch
index 4d7fb76308683e..011dd48f8e14f3 100644
--- a/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch
+++ b/package/network/utils/iproute2/patches/155-keep_tirpc_optional.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -378,7 +378,7 @@ check_selinux()
+@@ -349,7 +349,7 @@ check_selinux()
  
  check_tirpc()
  {
diff --git a/package/network/utils/iproute2/patches/170-ip_tiny.patch b/package/network/utils/iproute2/patches/170-ip_tiny.patch
index 71081c36bccb98..149bcd2afcbb6c 100644
--- a/package/network/utils/iproute2/patches/170-ip_tiny.patch
+++ b/package/network/utils/iproute2/patches/170-ip_tiny.patch
@@ -30,15 +30,15 @@
  		"Usage: ip [ OPTIONS ] OBJECT { COMMAND | help }\n"
  		"       ip [ -force ] -batch filename\n"
 +#ifndef IPROUTE2_TINY
- 		"where  OBJECT := { address | addrlabel | amt | fou | help | ila | ioam | l2tp |\n"
- 		"                   link | macsec | maddress | monitor | mptcp | mroute | mrule |\n"
+ 		"where  OBJECT := { address | addrlabel | fou | help | ila | ioam | l2tp | link |\n"
+ 		"                   macsec | maddress | monitor | mptcp | mroute | mrule |\n"
  		"                   neighbor | neighbour | netconf | netns | nexthop | ntable |\n"
- 		"                   ntbl | route | rule | sr | tap | tcpmetrics |\n"
+ 		"                   ntbl | route | rule | sr | stats | tap | tcpmetrics |\n"
  		"                   token | tunnel | tuntap | vrf | xfrm }\n"
 +#else
-+		"where  OBJECT := { address | link | maddress | monitor |\n"
++		"where  OBJECT := { address | help | link | maddress | monitor |\n"
 +		"                   neighbor | neighbour | netns | route |\n"
-+		"                   rule | token | tunnel }\n"
++		"                   rule | stats | token | tunnel }\n"
 +#endif
  		"       OPTIONS := { -V[ersion] | -s[tatistics] | -d[etails] | -r[esolve] |\n"
  		"                    -h[uman-readable] | -iec | -j[son] | -p[retty] |\n"
diff --git a/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch b/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch
deleted file mode 100644
index aef51395a95872..00000000000000
--- a/package/network/utils/iproute2/patches/175-reduce-dynamic-syms.patch
+++ /dev/null
@@ -1,45 +0,0 @@
---- a/tc/Makefile
-+++ b/tc/Makefile
-@@ -106,7 +106,7 @@ LDLIBS += -L. -lm
- 
- ifeq ($(SHARED_LIBS),y)
- LDLIBS += -ldl
--LDFLAGS += -Wl,-export-dynamic
-+LDFLAGS += -Wl,--dynamic-list=dynsyms.list
- endif
- 
- TCLIB := tc_core.o
-@@ -135,7 +135,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
- all: tc $(TCSO)
- 
- tc: $(TCOBJ) $(LIBNETLINK) libtc.a
--	$(QUIET_LINK)$(CC) $^ $(LDFLAGS) $(LDLIBS) -o $@
-+	$(QUIET_LINK)$(CC) $(filter-out dynsyms.list, $^) $(LDFLAGS) $(LDLIBS) -o $@
- 
- libtc.a: $(TCLIB)
- 	$(QUIET_AR)$(AR) rcs $@ $^
-@@ -157,6 +157,7 @@ install: all
- clean:
- 	rm -f $(TCOBJ) $(TCLIB) libtc.a tc *.so emp_ematch.tab.h; \
- 	rm -f emp_ematch.tab.*
-+	rm -f dynsyms.list
- 
- m_xt.so: m_xt.c
- 	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic -o m_xt.so m_xt.c $$($(PKG_CONFIG) xtables --cflags --libs)
-@@ -193,4 +194,16 @@ static-syms.h: $(wildcard *.c)
- 		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:extern char \1[] __attribute__((weak)); if (!strcmp(sym, "\1")) return \1;:;p}' $$files ; \
- 	done > $@
- 
-+else
-+
-+tc: dynsyms.list
-+m_xt.so: dynsyms.list
-+dynsyms.list: $(wildcard *.c)
-+	files="$(filter-out $(patsubst %.so,%.c,$(TCSO)), $^)" ; \
-+	echo "{" > $@ ; \
-+	for s in `grep -B 3 '\<dlsym' $$files | sed -n '/snprintf/{s:.*"\([^"]*\)".*:\1:;s:%s::;p}'` ; do \
-+		sed -n '/'$$s'[^ ]* =/{s:.* \([^ ]*'$$s'[^ ]*\) .*:\1;:;p}' $$files ; \
-+	done >> $@ ; \
-+	echo "show_stats; print_nl; print_tm; parse_rtattr; parse_rtattr_flags; get_u32; matches; addattr_l; addattr_nest; addattr_nest_end; };" >> $@
-+
- endif
diff --git a/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch b/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
index 765e4ad2e8726a..545075fd857487 100644
--- a/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
+++ b/package/network/utils/iproute2/patches/190-fix-nls-rpath-link.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -270,7 +270,7 @@ int main(int argc, char **argv) {
+@@ -241,7 +241,7 @@ int main(int argc, char **argv) {
  }
  EOF
  
@@ -9,7 +9,7 @@
      local ret=$?
  
      rm -f $TMPDIR/libbpf_test.c $TMPDIR/libbpf_test
-@@ -288,7 +288,7 @@ int main(int argc, char **argv) {
+@@ -259,7 +259,7 @@ int main(int argc, char **argv) {
  }
  EOF
  
diff --git a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
index 8156adbf050fca..b0020763823867 100644
--- a/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
+++ b/package/network/utils/iproute2/patches/195-build_variant_ip_tc.patch
@@ -11,7 +11,7 @@
  
 --- a/tc/Makefile
 +++ b/tc/Makefile
-@@ -132,7 +132,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
+@@ -120,7 +120,7 @@ MODDESTDIR := $(DESTDIR)$(LIBDIR)/tc
  	$(QUIET_CC)$(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) -shared -fpic $< -o $@
  
  
diff --git a/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch b/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
index 92bf5cb66d875d..e41be20f108f8e 100644
--- a/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
+++ b/package/network/utils/iproute2/patches/200-drop_libbsd_dependency.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -435,14 +435,8 @@ EOF
+@@ -407,14 +407,8 @@ EOF
      if $CC -I$INCLUDE -o $TMPDIR/strtest $TMPDIR/strtest.c >/dev/null 2>&1; then
  	echo "no"
      else
diff --git a/package/network/utils/iproute2/patches/300-selinux-configurable.patch b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
index a611ba75f0f18d..36ecc735a74d4a 100644
--- a/package/network/utils/iproute2/patches/300-selinux-configurable.patch
+++ b/package/network/utils/iproute2/patches/300-selinux-configurable.patch
@@ -1,6 +1,6 @@
 --- a/configure
 +++ b/configure
-@@ -365,7 +365,7 @@ check_libbpf()
+@@ -336,7 +336,7 @@ check_libbpf()
  check_selinux()
  # SELinux is a compile time option in the ss utility
  {