Bug#1136961: openvpn broke after linux kernel 6.12.88-1 update

[Pirate Praveen]

On 5/17/26 11:12 PM, Bernhard Schmidt wrote:

Hi Pirate,

 > linux-image-amd64 was updated to latest version 6.12.88-1 from trixie

security to fix recent security vulnerabilities.

That sounds weird and would be surprising, but you never know. I'll try to reproduce, in the meantime a few questions: a) do you have the old (openvpn 2.6-series) DCO kernel module installed? It is packaged as https://tracker.debian.org/pkg/openvpn-dco-dkms

openvpn-dco-dkms is not installed.

b) Can you compare the output on connection between both kernel versions?

Any specific commands I can try? ping 9.9.9.9 simply does not work.

$ ping 9.9.9.9
PING 9.9.9.9 (9.9.9.9) 56(84) bytes of data.

I just reproduced it on our staging server as well.

root@vpn-staging:~# uname -a


root@vpn-staging:~# apt policy linux-image-cloud-amd64
linux-image-cloud-amd64:
  Installed: 6.12.88-1
  Candidate: 6.12.88-1

Linux vpn-staging 6.12.88+deb13-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.88-1 (2026-05-15) x86_64 GNU/Linux

c) Can you, if possible, verify the same behaviour using the 2.7 trixie- backports version?

it does not work with openvpn from trixie-backports as well. Connects, but no ping or other connections - breaks a mosh session, no ssh as well.

d) which one is the old kernel version you were running that works fine?

Old working version.

An additional point, not sure if matters, we are using the cloud variant of the kernel. So please try with this kernel variant as well. Linux vpn 6.12.86+deb13-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.86-1 (2026-05-08) x86_64 GNU/Linux

Bernhard

OpenPGP_0x8F53E0193B294B75.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature