networkingMode=mirrored fails with VmSwitch error 0xc0010022 — FSE Switch extension vetoes NIC connection after KB5121003 (fse.sys 10.0.26100.8972)

[jchkoch]

Windows Version

Windows 11 25H2 OS Build: 10.0.26200.9168

WSL Version

2.9.4.0

Are you using WSL 1 or WSL 2?

• WSL 2
• WSL 1

Kernel Version

6.18.35.2-1

Distro Version

Ubuntu 24.04

Other Software

• G DATA Security Client (active, WFP-layer — no NDIS filter in adapter bindings)
• Cisco AnyConnect (installed; was fully stopped during testing — did not change outcome)
• Hyper-V enabled

Repro Steps

1. Set .wslconfig:
   [wsl2]
   networkingMode=mirrored
2. wsl --shutdown
3. Launch Ubuntu
4. Run ip addr show and ping 8.8.8.8

Expected Behavior

Mirrored adapters come UP with an IPv4 address matching the host network. ping 8.8.8.8 succeeds.

Actual Behavior

Adapters appear but remain DOWN with no IPv4 address and no default route. ping reports "Network is unreachable."

$ ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> ...
inet 10.255.255.254/32 brd 10.255.255.254 scope global lo
2: eth0: <BROADCAST,MULTICAST> state DOWN
3: loopback0: <BROADCAST,MULTICAST,UP,LOWER_UP> state UP
inet6 fe80::.../64 scope link noprefixroute
4-6: eth1-eth3: <BROADCAST,MULTICAST> state DOWN

$ ping 8.8.8.8
ping: connect: Network is unreachable

Diagnostic Logs

1. Hyper-V VmSwitch errors (Event IDs 32 & 35)

On every WSL launch, the System event log records:

Event ID 32:
Failed to connect NIC 91DBF3C7-...--D4801BE4-... to port 5D6E548E-... on switch
30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0, status = 0xc0010022.

Event ID 35:
Failed to connect NIC 91DBF3C7-...--D4801BE4-... to port 5D6E548E-... on switch
30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0 (Friendly Name: FSE Switch).
The task was vetoed by a switch extension, or the switch extension stack is corrupted.
Status = 0xc0010022.

The switch GUID 30BE601B-A2AB-4EDC-9AD5-9D2600CF7CF0 has friendly name "FSE Switch".

2. FSE driver details

Service: fse
Display: Flow steering engine
ImagePath: system32\drivers\fse.sys
Start: 0 (BOOT_START)
Group: NDIS Wrapper
Type: 1 (KERNEL_DRIVER)

Registry: HKLM\SYSTEM\CurrentControlSet\Services\fse\Parameters
FlowSteeringEnabled = 1

fse.sys is a Microsoft kernel driver that implements the Hyper-V "FSE Switch" — the virtual switch used by WSL2 mirrored networking.

3. fse.sys was updated by KB5121003 (August 2026 Cumulative Update)

The active driver and WinSxS component store show a version change matching today's update:

fse.sys version
Date
Size
Source
10.0.26100.8737
Jul 15, 2026
230,896 bytes
July CU (KB5120102) — mirrored mode worked
10.0.26100.8972
Aug 20, 2026 1:33 PM
230,888 bytes
August CU (KB5121003) — mirrored mode broken

The active C:\Windows\System32\drivers\fse.sys (230,888 bytes, modified Aug 20 13:33) exactly matches the WinSxS version .8972. The file changed (size differs by 8 bytes, version incremented) as part of KB5121003.

Other KBs installed the same day cannot be responsible:

• KB5120708 = .NET Framework 3.5/4.8.1 cumulative update (no kernel driver payloads)
• KB5123304 = Servicing Stack Update, bundled inside KB5121003 (only servicing stack)

4. Regression — worked before the update

Mirrored networking mode was working before today's updates. The only changes were:

• KB5121003 (August 2026 Cumulative Update)
• A firmware update (applied the same day)
• WSL updated from 2.7.12.0 to 2.9.4.0 (prerelease)

G DATA Security Client, FSE, and Cisco AnyConnect were all active before the update and mirrored mode worked. Stopping Cisco AnyConnect completely (service, process, and vpnva driver) did not restore networking.

5. What was already tried (all failed to restore networking)

• wsl --shutdown and relaunch
• Full reboot
• Stopping Cisco AnyConnect (service + process + vpnva driver)
• Changing IPv6 DisabledComponents registry value and rebooting
• Upgrading WSL to prerelease 2.9.4.0
• Elevated wsl --shutdown + hnsdiag reset all

Hypothesis

The August 2026 cumulative update (KB5121003) updated fse.sys from version 10.0.26100.8737 to 10.0.26100.8972. The new version of the Flow Steering Engine driver is vetoing NIC connections to the FSE Switch (error 0xc0010022), which prevents WSL2 mirrored networking from bringing up its virtual adapters. This is a regression introduced by the fse.sys code change in that update.

Request

1. Can the WSL team investigate whether the fse.sys change in KB5121003 (build 26100.8972) broke mirrored networking?
2. Is there a workaround short of uninstalling the security update?
3. Would disabling the fse driver (Start=4) be a safe temporary workaround, or is FSE required for other Hyper-V networking features?

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise, please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use .\collect-wsl-logs.ps1 -LogProfile networking instead, following the instructions in Collect WSL logs for networking issues

Once completed please upload the output files to this GitHub issue.

See Collect WSL logs (recommended method).

If you choose to email these logs instead of attaching them to the bug, please send them to wsl-gh-logs@microsoft.com with the GitHub issue number in the subject, and include a link to your GitHub issue comment in the message body, and reply with '/emailed-logs'.

[jchkoch]

WslLogs-2026-08-20_16-20-21.tar.gz

[jchkoch]

WslLogs-2026-08-20_16-23-03.tar.gz run with .\collect-wsl-logs.ps1 -LogProfile networking

[github-actions]

Diagnostic information

Appx package is not installed

[github-actions]

Diagnostic information

Appx package is not installed

[jchkoch]

Update: Workaround found — corrupted FSE switch state across multiple physical adapters

After further investigation, the issue is resolved. The root cause was stale/corrupted FSE switch extension state, not the fse.sys version update.

What was ruled out

• KB5121003 was a red herring. I uninstalled it, which rolled fse.sys back from version 10.0.26100.8972 → 10.0.26100.8737 (the July version that was previously working) and dropped the OS build from 26200.9168 → 26200.8875. The VmSwitch error 0xc0010022 persisted with the older driver, confirming the fse.sys version change was coincidental, not causal.
• Restarting hns and vmcompute services did not help.
• netsh winsock reset / netsh int ip reset + reboot did not help.
• Stopping Cisco AnyConnect (service, process, and vpnva driver) did not help.
• Changing IPv6 DisabledComponents and rebooting did not help.

What worked

The system has multiple physical network adapters: Intel Wi-Fi 7 BE200 (WiFi), Realtek USB GbE (Ethernet), ASIX USB to Gigabit Ethernet (Ethernet), and Cisco AnyConnect Virtual Miniport (VPN). When WSL2 mirrored mode starts, the FSE Switch attempts to mirror all connected adapters.

The workaround:

1. wsl --shutdown
2. Physically unplug all Ethernet cables — leave only WiFi connected
3. Launch WSL2 with networkingMode=mirrored
4. Mirrored networking comes up successfully — ip addr show shows adapters UP with IPv4, ping 8.8.8.8 works
5. Re-plug Ethernet
6. wsl --shutdown
7. Launch WSL2 again — mirrored networking continues to work with all adapters connected

Interpretation

The FSE switch extension had gotten into a corrupted/stale state — likely triggered by a firmware update that changed one of the Ethernet adapters' capabilities while the switch had cached state for the old configuration. When all adapters were present at startup, FSE tried to reuse the stale state, hit the veto (0xc0010022), and the entire switch initialization failed — leaving all mirrored adapters DOWN with no IPv4 address and no default route.

Removing the Ethernet adapters forced FSE to rebuild the switch from scratch with only the WiFi adapter. Once the switch was in a clean state, re-adding the Ethernet adapters on the next WSL2 restart worked fine.

The error message's alternative explanation — "the switch extension stack is corrupted" — appears to be the accurate one, rather than a driver version regression.

Suggestion

It would be helpful if the FSE switch extension could detect stale/corrupted state and automatically rebuild, rather than silently vetoing all NIC connections and leaving mirrored networking completely non-functional with no actionable error message in WSL itself. The 0xc0010022 veto only appears in the Windows System event log under Microsoft-Windows-Hyper-V-VmSwitch — a WSL2 user would have no way to discover this without digging into Event Viewer.

[jchkoch]

Leaving this open as the root cause (FSE switch not recovering from corrupted state) is still unaddressed. Happy to close if the team considers this a known/duplicate issue.