diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 347dd32915723..52d1c979f5a05 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -702,6 +702,27 @@ static int nf_tables_updtable(struct nft_ctx *ctx)
 	return ret;
 }
 
+static bool nft_supported_family(u8 family)
+{
+	return false
+#if IS_ENABLED(CONFIG_NF_TABLES_INET)
+		|| family == NFPROTO_INET
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_IPV4)
+		|| family == NFPROTO_IPV4
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_ARP)
+		|| family == NFPROTO_ARP
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_BRIDGE)
+		|| family == NFPROTO_BRIDGE
+#endif
+#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
+		|| family == NFPROTO_IPV6
+#endif
+		;
+}
+
 static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 			      struct sk_buff *skb, const struct nlmsghdr *nlh,
 			      const struct nlattr * const nla[])
@@ -715,6 +736,9 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk,
 	struct nft_ctx ctx;
 	int err;
 
+	if (!nft_supported_family(family))
+		return -EOPNOTSUPP;
+
 	afi = nf_tables_afinfo_lookup(net, family, true);
 	if (IS_ERR(afi))
 		return PTR_ERR(afi);