Microsoft says a recent run of Windows 11 updates is triggering VPN connectivity failures inside Windows Subsystem for Linux (WSL)—a problem that primarily hits enterprise users who rely on corporate VPN access.
According to Microsoft’s known-issue notes, the bug shows up after installing the KB5067036 non-security preview update (Oct. 28, 2025) or later updates, including the KB5072033 cumulative update from Dec. 9, 2025 (Patch Tuesday).
What’s breaking
On affected machines, WSL loses access to some destinations over VPN when mirrored mode networking is enabled. Users typically see WSL errors like “No route to host,” even though the Windows host can reach the same services normally.
Microsoft says the issue impacts some third-party VPN clients, including OpenVPN and enterprise tools such as Cisco Secure Client (formerly Cisco AnyConnect). The underlying cause, per Microsoft, is that the VPN’s virtual network interface doesn’t respond to ARP (Address Resolution Protocol) requests, which are required to map IP addresses to MAC addresses on a local network segment.
The company also noted that Windows Home and Pro users are unlikely to run into this, since the problem is mainly tied to enterprise VPN scenarios—especially access to corporate resources (including DirectAccess).
Why mirrored mode matters in WSL
Mirrored mode networking is a WSL networking option introduced as an opt-in/experimental feature in 2023, designed to improve networking behavior in common real-world setups—particularly VPN compatibility, plus support improvements like IPv6 and multicast, and easier connectivity between WSL, the LAN, and Windows services.
When it works, it can make WSL feel far less “walled off.” When it doesn’t—like now—VPN users can get stuck with a Linux environment that can’t route to internal resources.
Is there a fix?
Microsoft says it’s investigating, but hasn’t shared a timeline for a permanent fix yet.
In the meantime, the most practical mitigation for many environments is to disable mirrored mode networking and revert to the default NAT-based networking setup for WSL (where supported in your configuration). It’s not ideal—especially if you enabled mirrored mode specifically to improve VPN behavior—but it can restore access while Microsoft and VPN vendors work through the ARP/interface interaction.
Quick WSL context: where this fits
WSL itself dates back to 2016, when Microsoft introduced it as a way to run Linux userland on Windows. WSL 2 was announced in May 2019 as a major step forward, shipping a real Linux kernel in a lightweight VM for better compatibility and performance.
More recently, Microsoft open-sourced WSL at Build 2025, publishing most of the code on GitHub while keeping a small set of Windows-integrated components closed.