[Bug 2166071] Re: Regression in 6.8.0-138-generic: Docker embedded DNS 127.0.0.11 times out, works with 6.8.0-137-generic

Thanks for submitting the bug report, and I'm glad the kernel update seems to have restored behavior back too normal. For now we can leave the bug as Invalid, but if others encounter a similar issue in the future, they can reference this bug or perhaps open a new report. Thank you! -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2166071 Title: Regression in 6.8.0-138-generic: Docker embedded DNS 127.0.0.11 times out, works with 6.8.0-137-generic Status in linux package in Ubuntu: Invalid Bug description: Ubuntu 24.04.4 LTS There appears to be a kernel networking/DNS regression between 6.8.0-137-generic and 6.8.0-138-generic affecting Docker containers. After upgrading and booting kernel 6.8.0-138-generic, multiple unrelated Docker containers fail DNS resolution through Docker's embedded DNS resolver 127.0.0.11. Examples: CrowdSec: lookup version.crowdsec.net on 127.0.0.11:53: read udp ... ->127.0.0.11:53: i/o timeout NetBird: lookup pkgs.netbird.io on 127.0.0.11:53: read udp ... ->127.0.0.11:53: i/o timeout Watchtower: lookup index.docker.io on 127.0.0.11:53: read udp ... ->127.0.0.11:53: i/o timeout The problem appeared immediately after upgrading to and booting 6.8.0-138-generic. To verify the regression, I rebooted the same host using the previously installed kernel 6.8.0-137-generic. Without making any changes to Docker, the Docker networks, DNS configuration or the affected containers, DNS resolution immediately started working again. Affected kernel: 6.8.0-138-generic linux-image-6.8.0-138-generic 6.8.0-138.138 Working kernel: 6.8.0-137-generic linux-image-6.8.0-137-generic 6.8.0-137.137 Affected kernel uname: Linux dkr02 6.8.0-138-generic #138-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 31 22:41:49 UTC 2026 x86_64 GNU/Linux Steps to reproduce: 1. Boot the host with 6.8.0-138-generic. 2. Start the existing Docker containers. 3. DNS requests through Docker's embedded resolver 127.0.0.11 time out. 4. Reboot the identical host with 6.8.0-137-generic. 5. DNS resolution from the same Docker containers works again. Expected result: Docker container DNS resolution should continue to work after upgrading from kernel 6.8.0-137 to 6.8.0-138. Actual result: With 6.8.0-138, DNS requests from multiple Docker containers time out at Docker's 127.0.0.11 resolver. The issue is reproducible by changing only the booted kernel. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2166071/+subscriptions