Microsoft has released a cumulative update for Windows 11 that plugs a hole in the Windows Subsystem for Linux 2 (WSL 2) networking stack, restoring mirrored-mode connectivity that had been broken when a VPN was active. The January 13, 2026 update, KB5074109, targets a specific regression introduced in the earlier KB5067036 preview release, which left WSL distributions unable to reach corporate resources even though the VPN connection appeared healthy on the Windows side. For developers, sysadmins, and IT professionals who rely on WSL 2 for daily work inside organizational networks, the fix cannot come soon enough.

A Regression Introduced by KB5067036

In early January 2026, Microsoft rolled out the KB5067036 preview update for Windows 11 24H2 and 25H2. Almost immediately, users on corporate VPNs noticed a peculiar failure: their Windows machine would connect to the VPN without issue, but any WSL 2 distribution using the newer mirrored networking mode could no longer reach internal servers, package feeds, or source-control systems. Pings would return “No route to host,” and name resolution against private DNS zones would fail.

The root cause, as documented by Microsoft, was an ARP-related bug tied to VPN virtual interfaces. When mirrored networking was active, these interfaces did not respond properly to ARP requests, effectively cutting off the Linux environment from anything beyond the local machine. The issue was widely discussed in developer forums and on GitHub, with many pointing to mirrored mode’s promise of seamless VPN compatibility as the very feature that had now turned sour.

What KB5074109 Brings to the Table

KB5074109 is a cumulative update that directly addresses the ARP regression from KB5067036. After installing it, WSL 2 mirrored networking should again relay traffic through the active VPN tunnel as expected. The update is available via Windows Update and applies to two Windows 11 versions:

Windows 11 Version Target OS Build
24H2 26100.7623
25H2 26200.7623

Importantly, this fix does not make mirrored networking a universal solution for all VPN clients or network policies. It merely reverses a specific breakage introduced by the previous update. As we’ll see, there are still known incompatibilities and configuration nuances that administrators must navigate.

How to Tell If You’re Affected

If you use WSL 2 with a corporate VPN and your workflow broke after installing KB5067036, you are almost certainly experiencing this regression. The telltale sign is that Windows apps—browsers, Outlook, native Git clients—work fine over the VPN, but inside WSL 2, commands like curl, git clone, or apt update that target internal servers fail. DNS queries for private hostnames may also return empty results even though the same names resolve on the Windows host.

To confirm, open PowerShell and run:

wsl --status

Check that your distribution is listed as version 2. Then list the instances:

wsl --list --verbose

If you are using mirrored networking, your .wslconfig file (located in your user profile folder) will contain networkingMode=mirrored. With the VPN connected, try to resolve a known internal hostname from the Linux shell:

getent ahosts internal-service.example

If this fails while nslookup internal-service.example works from a Windows command prompt, you are likely facing the ARP issue—provided the timeline matches the KB5067036 installation.

The Fix: Applying KB5074109 and Updating WSL

Before tinkering with your WSL configuration, update Windows first. Here’s the sequence:

  1. Open Settings > Windows Update and click Check for updates.
  2. Install the available cumulative update. KB5074109 should appear if your system is on 24H2 or 25H2.
  3. Restart when prompted.
  4. Verify the build by pressing Win+R, typing winver, and confirming the OS build matches the table above.

Next, bring WSL itself up to date. In PowerShell (as a normal user, not admin), run:

wsl --update

After that, you can check the WSL version:

wsl --version

Once both Windows and WSL are current, restart the WSL environment:

wsl --shutdown

Now reconnect your VPN, launch your WSL distribution, and rerun the getent test. For many, internal hostnames will now resolve, and services will become reachable. If the problem vanishes, you’ve confirmed the fix.

Choosing the Right Networking Mode for VPNs

Even after applying KB5074109, mirrored mode may not be the best fit for every environment. WSL 2 offers multiple networking modes, each with its own trade‑offs. The three relevant options are:

  • NAT (default): A traditional NAT-based setup. Solid and predictable, but lacks features like IPv6 support and direct LAN access.
  • Mirrored: Mirrors the Windows network interfaces into Linux. This is the mode most affected by VPN issues, but when it works, it simplifies connectivity and enables listening on localhost from both sides.
  • VirtioProxy: An alternative networking backend that can sometimes succeed where mirrored mode fails.

Microsoft recommends starting with the mode that best fits your workload. However, a practical approach is to test each mode against your actual corporate requirements—not just whether the VPN “looks” connected, but whether you can resolve internal DNS names and reach the specific services you need (Git repos, CI/CD servers, internal NPM feeds, etc.).

To switch modes, edit (or create) the file %UserProfile%\.wslconfig and add:

[wsl2]
networkingMode=nat             # or mirrored or virtioproxy
dnsTunneling=true

After changing the mode, always run wsl --shutdown before retesting. The dnsTunneling=true line is critical for VPN scenarios, as it enables WSL to leverage Windows’ DNS policy—including the Name Resolution Policy Table (NRPT) often used by corporate VPN clients.

A structured test plan might look like this:

  1. Connect the VPN on Windows.
  2. Start your WSL distribution.
  3. Resolve an internal hostname: getent ahosts internal.example.
  4. Connect to the required service (e.g., curl https://internal.git.contoso.com).
  5. Disconnect and reconnect the VPN and repeat the name and service tests.
  6. Run wsl --shutdown, restart WSL, and test once more to ensure stability across restarts.

If mirrored mode passes all these checks after the patch, you can confidently keep it. If not, fall back to NAT (with DNS tunneling) as a reliable baseline. Only venture into virtioproxy if NAT does not satisfy the required workflow.

When Mirrored Mode Isn’t an Option: Known Incompatibilities

Microsoft’s own documentation explicitly lists VPN client versions that are incompatible with WSL mirrored networking. As of January 2026, these include:

  • Bitdefender 26.0.2.1
  • OpenVPN 2.6.501
  • McAfee Safe Connect 2.16.1.124

If your organization deploys one of these versions, do not spend time troubleshooting mirrored mode. Instead, configure NAT with DNS tunneling:

[wsl2]
networkingMode=nat
dnsTunneling=true

This setup still allows WSL to resolve internal names because the DNS tunneling feature funnels WSL’s DNS queries through the Windows resolver, which is already configured by the VPN client. Test the workflow thoroughly; if NAT meets all business needs, it is a perfectly valid—and often more stable—choice.

DNS Tunneling: The Unsung Hero

Much of the VPN-with-WSL puzzle revolves around DNS, not just routing. A common scenario is that Windows can pluck a private hostname from the VPN’s DNS server, but the Linux guest either uses a different resolver or bypasses the VPN interface altogether. Microsoft’s DNS tunneling feature, available since Windows 11 22H2, addresses this by virtualizing DNS queries within WSL so they pass through the Windows network stack. This ensures that any custom DNS settings, proxy configurations, or NRPT rules applied by the VPN client are honored inside WSL.

Enabling DNS tunneling is as simple as adding dnsTunneling=true under the [wsl2] section of .wslconfig. It can coexist with any networking mode. If you ever find that WSL can reach the public internet but not internal corporate zones, DNS tunneling should be your first troubleshooting step.

Be cautious about manually editing Linux’s /etc/resolv.conf. While it is technically possible to point WSL to a public DNS server like 8.8.8.8, that will break internal name resolution. Stick with the tunnel and let Windows manage the DNS path.

Looking Ahead: Test, Document, and Stay Current

KB5074109 delivers a surgical fix for a specific regression, but the broader challenge of integrating Linux development environments into corporate Windows networks will persist. WSL’s networking feature set—mirrored mode, DNS tunneling, virtioproxy—is still maturing, and each organization’s VPN stack differs. The best defense is a repeatable test regimen: pick a networking mode, confirm internal DNS and service access, and document the exact Windows build, WSL version, VPN product, and mode that works. That documentation will pay dividends when the next update arrives.

Keep an eye on the official WSL networking documentation and the WSL GitHub repository for announcements about new compatibility fixes. For now, install KB5074109, enable DNS tunneling, and systematically validate your connectivity. The goal isn’t just to get back online today—it’s to build a workflow that withstands the next patch Tuesday.