KB5068861 breaks mirror networking with VPN

[jptrosclair]

Windows Version

Windows 1124H2

WSL Version

2.6.2.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.6.87.2-1

Distro Version

Ubuntu 24.04

Other Software

No response

Repro Steps

After the update is installed, no longer able to access network resources on VPN. Able to access to internet, only seems to affect VPN. Uninstalling the update restores accessibility to network resources on the other side of the VPN tunnel.

> type ~\.wslconfig
[experimental]
networkingMode=mirrored
dnsTunneling=true

Expected Behavior

Expecting to be able to access network resources on other side of VPN tunnel post-KB5068861.

Actual Behavior

Attempts to connect or even ping hosts on the other side of the VPN tunnel fail. These errors are logged in the kernel dmesg output:

[    7.468330] WSL (218) ERROR: CheckConnection: getaddrinfo() failed: -5
[    7.501055] WSL (218) ERROR: CheckConnection: getaddrinfo() failed: -5
[    7.537935] WSL (218) ERROR: CheckConnection: connect() failed: 101

Diagnostic Logs

No response

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use collect-networking-logs.ps1, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[robertromore]

Also experiencing this. Putting the computer to sleep and re-waking it seems to fix it.

Edit: this seems to only work for about 10 minutes or so.

[jptrosclair]

This is a corporate PC and I'm unable to collect and upload logs due to restrictions outside of my control. I apologize.

I will add that I did update to the pre-release version of WSL with wsl --update --prerelease to see if that corrected the problem, and it did NOT. I was previously tracking the stable releases. I attempted multiple restarts of WSL with no luck. The only solution I found was to remove the update.

[simon376]

I'm facing the same issue, but uninstalling the update mentioned unfortunately did not solve the issue.
Here are the WSL logs as requested, which may help you:

Networking Logs upload failed on GitHub and will be sent via email

WslLogs-2025-11-17_10-28-43.zip

[Ueland]

A colleague of me had this issue today where KB5068861 broke network connectivity. But in this case there was no .wslconfig file, so everything had default settings. Uninstalling the update brought network connectivity back. Unfortunately no debug logs.
PS: We have tested this on multiple machines with the same hardware, no others have reported this issue. (I myself have this update and have no problems)

[ChamDK]

Same, recently updates have broken WSL when VPN is used.

I am unsure if it exactly this KB because i can't uninstall it.

14 days ago everything worked fine.
After a larger windows update, it broke. Because of company policy i can't roll back.

but i see other similar posts regarding VPN and WSL that do not play well together.

[srbollin]

We’re seeing the same issue in our environment after installing KB5068861.

Environment (multiple dev workstations):

• Windows 11 (KB5068861 installed)

• WSL 2
  WSL version: 2.6.1.0
  Kernel version: 6.6.87.2-1
  WSLg version: 1.0.66
  MSRDC version: 1.2.6353
  Direct3D version: 1.611.1-81528511
  DXCore version: 10.0.26100.1-240331-1435.ge-release
  Windows version: 10.0.26100.6899

• Distro: Oracle Linux 9.5 (plus other distros)

• .wslconfig uses mirrored networking:

  [wsl2]
  autoProxy=true
  dnsTunneling=true
  networkingMode=mirrored

Symptom:

• From inside WSL, any connection that needs to go over our corporate VPN fails with No route to host.
• From the Windows host, the same destinations are reachable over VPN with no issue.
• Internet access (non-VPN) from WSL appears to work.
• We also noticed, systemd stopped working with latest patch.

Mitigation:

• Uninstalling KB5068861 with:

  wusa /uninstall /kb:5068861

  and rebooting immediately restores WSL networking, with no other config changes.

• Reinstalling KB5068861 reproduces the breakage 100% on affected machines.

Impact:

• A large portion of our team relies on WSL for day-to-day work, so this update is currently blocking normal workflows.

If there are specific logs that would help, we’re happy to collect, redact, and attach them.

[brianedwards00]

And I thought I was going crazy because I haven't changed anything. @srbollin 's solution worked for me!

[etyoma]

the same like above

• Windows 11
• wsl --version
  WSL version: 2.6.1.0
  Kernel version: 6.6.87.2-1
  WSLg version: 1.0.66
  MSRDC version: 1.2.6353
  Direct3D version: 1.611.1-81528511
  DXCore version: 10.0.26100.1-240331-1435.ge-release
  Windows version: 10.0.26100.7171
• Guest OS Oracle Linux 9.5

uninstalling KB5068861 fully solves the issue
but corp policy installs it back and immediately requires reboot

[randommen96]

Me and my coworkers have the same issue, uninstalling the KB makes it work again, however that is not preferred.

Tried multiple wsl versions, as well as distro's, but no luck.

Happy to provide logs.

[hovisms]

Same issue here. This impacts both mirrored and NAT modes. Unfortunately, my attempts to uninstall the KB result in an error state after reboot and windows reverting so that the KB remains installed.

[krutoileshii]

Same issue. unfortunately uninstalling the the KB is not an option either.

[randommen96]

In summary, a coworker found that the arp request is not answered for the ethernet interface of the VPN application.

Adding it manually makes it work with:
sudo arp -s 1.2.3.4 11:22:33:44:55:66 -i ethX

I keep a ping open in a seperate tab to keep the arp alive.

So far this seems to work for me as a temporary workaround while keeping KB5068861 installed.

++ It looks like a ping in the background isn't needed to keep the arp entry, as it is added permanently with above command, at least for the time WSL is running.