#1135527 linux-image-6.1.0-45-amd64: probable borked netfilter patch / log spamming in bookworm release 6.1.170-1

Package:
src:linux
Source:
src:linux
Submitter:
Brad Barnett
Date:
2026-05-10 18:37:02 UTC
Severity:
normal
Tags:
#1135527#5
Date:
2026-05-02 08:07:42 UTC
From:
To:
After a bookworm upgrade today to:
Linux hostname 6.1.0-45-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.170-1 (2026-04
-30) x86_64 GNU/Linux

The following logs started to appear from time to time (src IP last octlets re
placed with ?):
May  2 03:49:36 hostname kernel: [41116.686651] icmp: detected local route for
 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.687120] icmp: detected local route for
 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.687223] icmp: detected local route for
 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.687660] icmp: detected local route for
 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.688718] icmp: detected local route for
 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.689117] icmp: detected local route for 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.690593] icmp: detected local route for 192.168.1.2 during ICMP sending, src 151.101.?.?
May  2 03:49:36 hostname kernel: [41116.691051] icmp: detected local route for 192.168.1.2 during ICMP sending, src 151.101.?.?


I have hundreds of bookworm hosts reporting this, all with unrelated iptables / networking configs.

Some additional information:

- absolutely no iptables, routing, or other configurations have changed on any of these hosts (spread over multiple worksites)

- the previous bookworm kernel image did report this

- kernel upgrades for bullseye and trixie today do not exhibit this problem, eg, this is isolated to bookworm only

- hosts on bookworm and trixie with identical routing/firewalling, show this issue only on bookworm

I suspect a bad patch, or a partial patch related to:

https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.165
commit 1e20f24509da2a1485dcef76ed8fb9cc34c90dc5
Author: Fernando Fernandez Mancera <fmancera@suse.de>
Date:   Mon Jan 19 21:35:46 2026 +0100

But I could be wrong.  I'm just basing this on the 170 changlog with:

    - netfilter: nf_conncount: fix tracking of connections from localhost

I've rated this at higher priority, as I'm not sure of the implications here.  Whatever is broken, is literally messing with the src (see the patch I refernced above) of the packet, it seems possible conntrack breakage, and whatever else that might imply.

Happy to provide any full tcpdumps (privately), packet captures, etc.

Still looking into this, but felt it best to report ASAP.

#1135527#10
Date:
2026-05-02 08:24:42 UTC
From:
To:
Hi,

Thanks for your report. This is the same as #1135514 so I'm merging
them.

Regards,
Salvatore

#1135527#19
Date:
2026-05-02 08:22:10 UTC
From:
To:
Not sure how this snuck through, but:


- the previous bookworm kernel image did report this

SHOULD BE:

- the previous bookworm kernel image did NOT report this

Sorry for any confusion.

#1135527#22
Date:
2026-05-10 18:35:58 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
linux, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1135514@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated linux package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 08 May 2026 21:59:49 +0200
Source: linux
Architecture: source
Version: 6.1.170-3
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1135514
Changes:
 linux (6.1.170-3) bookworm-security; urgency=high
 .
   * xfrm: esp: ipv4: fix up flags setting
   * net: Fix icmp host relookup triggering ip_rt_bug (Closes: #1135514)
Checksums-Sha1:
 38fd8c71b55be01dcd60e86d4511abbebc06d52a 399396 linux_6.1.170-3.dsc
 9e84ce14c6ed41902623fc395b793c72dad2df55 1841740 linux_6.1.170-3.debian.tar.xz
 374e15f800c75d978414af29fc2964bb6cbd3833 6992 linux_6.1.170-3_source.buildinfo
Checksums-Sha256:
 03fb7bff881839fa29297adeade96dd8d7cd1edaaf2d03669220146d7a175478 399396 linux_6.1.170-3.dsc
 25805b356526715f569ee3f0e123a567ff0791d68f097036b2dc7587f7c41c19 1841740 linux_6.1.170-3.debian.tar.xz
 a4c5e66a4160ffb5b2e60782fb8fb8e7c2010e83b2efda1428ffe65d4fc4d90f 6992 linux_6.1.170-3_source.buildinfo
Files:
 701b4c652c05897963f896753424a844 399396 kernel optional linux_6.1.170-3.dsc
 7334f975f7ddf483e1e2705e3ff881ba 1841740 kernel optional linux_6.1.170-3.debian.tar.xz
 490f2205601370ec87d10bb700481e4f 6992 kernel optional linux_6.1.170-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmn+QRxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EhEwP/3fyb2HaC4ljx9P3f7MVkXbO1kPbHymn
S4lck52I53ZRaI0+tSdOIeBXcjYhEZ1k0nkWEmUtKtLCl9YFmxYCg3sJlLd7/efC
Hc1UZpiSRIPsqxCnhBm9Ip0/v20RBdRW49FQ29DprBN6cYdLnIq735nIy7IkL7NV
/VasHYgmynishs1MlVm7Pg5SQTAaIKwfSem62U0QeBbiaD3lgz5cu1KPOhpIaI7N
KTE08hr8zU6HYfOTwJm9B8t9opP1qYNo1HcapMNBgKzoo8psZ6fVSEcxomI+hmxD
Dhh6/+c8letjnvjxgiH9vliXTpiCFC+edmRUiqQtHqtLKH6DzemYTCARTDIiLnvL
GGlyb+Jbgv5FCGn7cI//I/kcQs3S1w8WwMID/CQilaPtIVSHsqqWtCGjW9Y1OlC9
694JtfDF8S+BvjOP12+1+IHl8B7A8rwr6S1gu2RSHDbvanQ1xXsQUG1iFSW/fS3s
YgnHLY0/Gl+v758dXlUcauCpGPaPgN/nalxBP+H++StEIEJ4D4tyjKJe3BgJ+KyY
pbfIGnV95L/Sn1dGmePBqDEpRNhAgHPiV5H6MfUlemwU1QWytrV60wsmtDOdR2Bi
sWqu2gSldj4jzvECzbCuxQKoXlGdcD6h7ZPY68Xtiu1pDuBoEMdIRC0qwPuPJGTO
eFsbTm2/8oue
=0xK1
-----END PGP SIGNATURE-----