Table of Contents
Why is my WSL losing internet connection after the latest Windows 11 update?
Developers and IT professionals rely on the Windows Subsystem for Linux (WSL) for seamless cross-platform workflows. However, recent Windows 11 patches have introduced a critical conflict involving mirrored networking and third-party VPN software. If you have installed updates from late 2025 and are experiencing connectivity failures within your Linux environment, you are likely encountering a known bug confirmed by Microsoft.
The Root Cause: ARP Request Failures
The conflict originates in how the virtual network interface handles communication protocols. Specifically, the issue arises because the VPN application’s virtual interface stops responding to Address Resolution Protocol (ARP) requests.
ARP is essential for mapping IP addresses to physical MAC addresses on a local network. When the VPN interface fails to acknowledge these requests, the Linux subsystem loses its ability to route traffic correctly, even if your main Windows host remains connected.
Affected Updates and Systems
This issue stems from the KB5067036 preview update released on October 28, 2025. It persists in subsequent cumulative updates released throughout November and December 2025. The problem specifically targets systems running Windows 11 versions 24H2 through 25H2 that utilize Mirrored Mode networking in WSL.
Symptoms and Diagnostics
Identifying this specific failure is straightforward if you check the connectivity logs within your Linux terminal. The primary symptom is a total loss of network access inside the WSL instance while the VPN is active.
- Error Message: You will typically see a “No route to host” error when attempting to ping external servers or connect to corporate resources.
- Host Connectivity: Crucially, your Windows host machine will retain full internet access and VPN connectivity. The breakage is isolated strictly to the bridged connection between the host and the Linux subsystem.
Impact on Enterprise Software
This bug does not affect all VPNs equally. Microsoft reports that the conflict is most prevalent with enterprise-grade solutions. Confirmed affected software includes:
- Cisco Secure Client: Previously known as Cisco AnyConnect, this is a standard for many corporate remote access environments.
- OpenVPN: A widely used open-source commercial software implementation.
Current Status and Mitigation
Microsoft has officially acknowledged this defect in the “Known Issues” documentation for KB5067036. Their engineering teams are investigating the root cause to develop a permanent patch.
Until a fix is deployed via Windows Update, users facing critical outages may need to alter their WSL networking configuration. Switching from “Mirrored Mode” back to the default Network Address Translation (NAT) mode often restores connectivity, though it sacrifices the benefits of network mirroring (such as IPv6 support and improved LAN compatibility).