Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
updating kernel via apt on 20260501

any ping from my host to a "down" host on my lan causes these messages to pile up in the ring buffer

Hi,

Thanks for your report.

This looks to be a consequence of/related to the backport of
81b84de32bb2 ("xfrm: fix ip_rt_bug race in icmp_route_lookup reverse
path") which landed in 6.1.165 upstream and thus included as well in
the recent bookworm-security update.

The change is net_warn_ratelimited() but it is not immediately clear
to me yet why this triggers on a bookworm kernel, whereas it does not
with on a trixie host with 6.12.85-1.

We will have a look.

Regards,
Salvatore

Hi,

So indeed, given this is the one emmiting the message reverting the
commit in 6.1.y "fixes" the problem. I'm going to contact upstream /
stable maintainers to see how to proceed, there might be a missing
requisite in 6.1.y causing the problem.

Regards,
Salvatore

Hi

[sending correctly including the needed mailinglists]

This is a 6.1.y specific regression, so I'm not CC'ing netdev, but
maintainers, hope this is fine. After a backport of 81b84de32bb2
("xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path") was
applied in the 6.1.y stable series as
9a95ec9144eeff1fc6fbcc21b677e322c6f1430b, user are reporting that on
pings to unreachable host the log is spammed with the "detected local
route for %pI4 during ICMP sending, src %pI4\n" messages.

One report is at: https://bugs.debian.org/1135514

This does not happens with other stable series versions (6.12.y
tested explicitly, 6.6.y I have not avaiable to test).

Is there a missing requisite in 6.1.y?

#regzbot introduced: 9a95ec9144eeff1fc6fbcc21b677e322c6f1430b
#regzbot link: https://bugs.debian.org/1135514

Regards,
Salvatore

I think it because we failed to backport  this patch before:
https://lore.kernel.org/stable/20250207161555-b1a8749027831a1a@stable.kernel.org/T/#m0c880c1f04f7211aea9b7f6b4de0b64aa1726417

Hi Jiayuan,

Which won't apply cleanly, I assume this was the reason it got not
backported to 6.1.y. Do you have a backport of that, or should the
original commit introducing the issue be reverted from 6.1.y?

Regards,
Salvtore

I tried to backport this patch to stable. Hope these patches apply successfully.

https://lore.kernel.org/stable/20260506012057.285743-1-jiayuan.chen@linux.dev/T/#u
https://lore.kernel.org/stable/20260506012115.286204-1-jiayuan.chen@linux.dev/T/#u

Hi Jiayuan,

I tried the patch on top of 6.1.170 and this resolves the issue. I
added the Tested-by to your patch submission.

Thank you.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135514@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated linux package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 08 May 2026 21:59:49 +0200
Source: linux
Architecture: source
Version: 6.1.170-3
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1135514
Changes:
 linux (6.1.170-3) bookworm-security; urgency=high
 .
   * xfrm: esp: ipv4: fix up flags setting
   * net: Fix icmp host relookup triggering ip_rt_bug (Closes: #1135514)
Checksums-Sha1:
 38fd8c71b55be01dcd60e86d4511abbebc06d52a 399396 linux_6.1.170-3.dsc
 9e84ce14c6ed41902623fc395b793c72dad2df55 1841740 linux_6.1.170-3.debian.tar.xz
 374e15f800c75d978414af29fc2964bb6cbd3833 6992 linux_6.1.170-3_source.buildinfo
Checksums-Sha256:
 03fb7bff881839fa29297adeade96dd8d7cd1edaaf2d03669220146d7a175478 399396 linux_6.1.170-3.dsc
 25805b356526715f569ee3f0e123a567ff0791d68f097036b2dc7587f7c41c19 1841740 linux_6.1.170-3.debian.tar.xz
 a4c5e66a4160ffb5b2e60782fb8fb8e7c2010e83b2efda1428ffe65d4fc4d90f 6992 linux_6.1.170-3_source.buildinfo
Files:
 701b4c652c05897963f896753424a844 399396 kernel optional linux_6.1.170-3.dsc
 7334f975f7ddf483e1e2705e3ff881ba 1841740 kernel optional linux_6.1.170-3.debian.tar.xz
 490f2205601370ec87d10bb700481e4f 6992 kernel optional linux_6.1.170-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmn+QRxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EhEwP/3fyb2HaC4ljx9P3f7MVkXbO1kPbHymn
S4lck52I53ZRaI0+tSdOIeBXcjYhEZ1k0nkWEmUtKtLCl9YFmxYCg3sJlLd7/efC
Hc1UZpiSRIPsqxCnhBm9Ip0/v20RBdRW49FQ29DprBN6cYdLnIq735nIy7IkL7NV
/VasHYgmynishs1MlVm7Pg5SQTAaIKwfSem62U0QeBbiaD3lgz5cu1KPOhpIaI7N
KTE08hr8zU6HYfOTwJm9B8t9opP1qYNo1HcapMNBgKzoo8psZ6fVSEcxomI+hmxD
Dhh6/+c8letjnvjxgiH9vliXTpiCFC+edmRUiqQtHqtLKH6DzemYTCARTDIiLnvL
GGlyb+Jbgv5FCGn7cI//I/kcQs3S1w8WwMID/CQilaPtIVSHsqqWtCGjW9Y1OlC9
694JtfDF8S+BvjOP12+1+IHl8B7A8rwr6S1gu2RSHDbvanQ1xXsQUG1iFSW/fS3s
YgnHLY0/Gl+v758dXlUcauCpGPaPgN/nalxBP+H++StEIEJ4D4tyjKJe3BgJ+KyY
pbfIGnV95L/Sn1dGmePBqDEpRNhAgHPiV5H6MfUlemwU1QWytrV60wsmtDOdR2Bi
sWqu2gSldj4jzvECzbCuxQKoXlGdcD6h7ZPY68Xtiu1pDuBoEMdIRC0qwPuPJGTO
eFsbTm2/8oue
=0xK1
-----END PGP SIGNATURE-----