RPi4 network/SSH lockout or freeze after upgrade to linux-image-6.18.29+rpt-rpi-v8 with Docker

[jmnovak50]

Describe the bug

I am seeing repeat network/SSH lockouts on a Raspberry Pi 4 after upgrading to linux-image-6.18.29+rpt-rpi-v8 from the Raspberry Pi apt repo.

The same host has been stable after reverting to 6.12.75+rpt-rpi-v8.

Environment:

• Raspberry Pi 4
• 64-bit Raspberry Pi OS / Debian 13 Trixie
• Ethernet
• Docker installed and in use
• Docker bridge/veth networking present
• Media/download workload, but I do not yet have a minimal reproducer

Observed behavior:

• After standard apt upgrade installed 6.18.29, the host became unreachable over SSH
• Hard reboot required
• Reverting the active boot kernel/initramfs to 6.12.75 restored stability
• The problem appears to recur when the system is running its normal Docker workload

Recovery steps that restored stability:
cp /boot/vmlinuz-6.12.75+rpt-rpi-v8 /boot/firmware/kernel8.img
cp /boot/initrd.img-6.12.75+rpt-rpi-v8 /boot/firmware/initramfs8
reboot

After reboot:
uname -r
6.12.75+rpt-rpi-v8

I also noticed that reinstalling linux-image-rpi-v8 currently pulls linux-image-6.18.29+rpt-rpi-v8 and copies it to /boot/firmware/kernel8.img via the postinst hook, which makes the system boot back into the failing kernel.

This may be related to Docker bridge/veth networking on RPi4. I can provide logs/package output if useful.

Steps to reproduce the behaviour

Steps to reproduce / observed failure path:

1. Start from a Raspberry Pi 4 running 64-bit Raspberry Pi OS / Debian 13 Trixie with Docker installed and Docker bridge/veth networking in use.

2. Run a standard apt upgrade that installs:

   • linux-image-6.18.29+rpt-rpi-v8
   • linux-image-rpi-v8

3. Confirm the post-install hook copies the 6.18.29 kernel into the active Raspberry Pi boot location:

   • /boot/vmlinuz-6.18.29+rpt-rpi-v8 -> /boot/firmware/kernel8.img
   • /boot/initrd.img-6.18.29+rpt-rpi-v8 -> /boot/firmware/initramfs8

4. Reboot into 6.18.29.

5. Run the system under its normal Docker-based media/download workload.

6. After some period of normal use, the host becomes unreachable over SSH / network. A hard reboot is required.

7. Revert the active boot kernel and initramfs to 6.12.75:

   cp /boot/vmlinuz-6.12.75+rpt-rpi-v8 /boot/firmware/kernel8.img
   cp /boot/initrd.img-6.12.75+rpt-rpi-v8 /boot/firmware/initramfs8
   reboot

8. Confirm after reboot:

   uname -r
   6.12.75+rpt-rpi-v8

9. With the same host and normal workload, the system is stable again on 6.12.75.

Device (s)

Raspberry Pi 4 Mod. B

System

https://pastebin.com/yghBDSND

Logs

Logs / diagnostic output:

I am currently stable again on 6.12.75, so the most useful logs are from the previous failed boot if journald retained them.

I can provide the following:

1. Current stable kernel:
   uname -a

2. OS version:
   cat /etc/os-release

3. Installed Raspberry Pi kernel / firmware packages:
   dpkg -l | egrep 'linux-image|linux-headers|raspi|raspberry|firmware|rpi-eeprom'

4. Previous boot kernel log:
   journalctl -b -1 -k --no-pager | tail -300

5. Previous boot suspicious kernel/system messages:
   journalctl -b -1 --no-pager | egrep -i 'panic|oops|watchdog|soft lockup|hung task|blocked for more|bcmgenet|eth0|veth|bridge|docker|conntrack|netfilter|nft|iptables|rtnetlink|segfault|oom'

6. Docker/network state:
   docker version
   docker network ls
   ip route
   ip -br addr

Additional context

===== uname =====
Linux hickory 6.12.75+rpt-rpi-v8 #1 SMP PREEMPT Debian 1:6.12.75-1+rpt1 (2026-03-11) aarch64 GNU/Linux
===== os-release =====
PRETTY_NAME="Debian GNU/Linux 13 (trixie)"
NAME="Debian GNU/Linux"
VERSION_ID="13"
VERSION="13 (trixie)"
VERSION_CODENAME=trixie
DEBIAN_VERSION_FULL=13.4
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
===== kernel / firmware packages =====
ii bluez-firmware 1.2-13+rpt2 all Firmware for Bluetooth devices
ii firmware-atheros 1:20250410-2+rpt1 all Binary firmware for Qualcomm Atheros wireless cards
ii firmware-brcm80211 1:20250410-2+rpt1 all Binary firmware for Broadcom/Cypress 802.11 wireless cards
ii firmware-libertas 1:20250410-2+rpt1 all Binary firmware for Marvell wireless cards
ii firmware-mediatek 1:20250410-2+rpt1 all Binary firmware for MediaTek and Ralink chips for networking, SoCs and media
ii firmware-realtek 1:20250410-2+rpt1 all Binary firmware for Realtek network and audio chips
ii linux-headers-6.12.25+rpt-common-rpi 1:6.12.25-1+rpt1+trixie all Common header files for Linux 6.12.25+rpt-rpi
ii linux-headers-6.12.25+rpt-rpi-2712 1:6.12.25-1+rpt1+trixie arm64 Header files for Linux 6.12.25+rpt-rpi-2712
ii linux-headers-6.12.25+rpt-rpi-v8 1:6.12.25-1+rpt1+trixie arm64 Header files for Linux 6.12.25+rpt-rpi-v8
ii linux-headers-6.12.62+rpt-common-rpi 1:6.12.62-1+rpt1 all Common header files for Linux 6.12.62+rpt-rpi
ii linux-headers-6.12.62+rpt-rpi-2712 1:6.12.62-1+rpt1 arm64 Header files for Linux 6.12.62+rpt-rpi-2712
ii linux-headers-6.12.62+rpt-rpi-v8 1:6.12.62-1+rpt1 arm64 Header files for Linux 6.12.62+rpt-rpi-v8
ii linux-headers-6.12.75+rpt-common-rpi 1:6.12.75-1+rpt1 all Common header files for Linux 6.12.75+rpt-rpi
ii linux-headers-6.12.75+rpt-rpi-2712 1:6.12.75-1+rpt1 arm64 Header files for Linux 6.12.75+rpt-rpi-2712
ii linux-headers-6.12.75+rpt-rpi-v8 1:6.12.75-1+rpt1 arm64 Header files for Linux 6.12.75+rpt-rpi-v8
ii linux-headers-6.18.29+rpt-common-rpi 1:6.18.29-1+rpt1 all Common header files for Linux 6.18.29+rpt-rpi
ii linux-headers-6.18.29+rpt-rpi-2712 1:6.18.29-1+rpt1 arm64 Header files for Linux 6.18.29+rpt-rpi-2712
ii linux-headers-6.18.29+rpt-rpi-v8 1:6.18.29-1+rpt1 arm64 Header files for Linux 6.18.29+rpt-rpi-v8
ii linux-headers-rpi-2712 1:6.18.29-1+rpt1 arm64 Header files for Linux rpi-2712 configuration (meta-package)
ii linux-headers-rpi-v8 1:6.18.29-1+rpt1 arm64 Header files for Linux rpi-v8 configuration (meta-package)
ii linux-image-6.12.25+rpt-rpi-2712 1:6.12.25-1+rpt1+trixie arm64 Linux 6.12 for Raspberry Pi 2712, Raspberry Pi
ii linux-image-6.12.25+rpt-rpi-v8 1:6.12.25-1+rpt1+trixie arm64 Linux 6.12 for Raspberry Pi v8, Raspberry Pi
rc linux-image-6.12.34+rpt-rpi-2712 1:6.12.34-1+rpt1 arm64 Linux 6.12 for Raspberry Pi 2712, Raspberry Pi
rc linux-image-6.12.34+rpt-rpi-v8 1:6.12.34-1+rpt1 arm64 Linux 6.12 for Raspberry Pi v8, Raspberry Pi
rc linux-image-6.12.47+rpt-rpi-2712 1:6.12.47-1+rpt1 arm64 Linux 6.12 for Raspberry Pi 2712, Raspberry Pi
rc linux-image-6.12.47+rpt-rpi-v8 1:6.12.47-1+rpt1 arm64 Linux 6.12 for Raspberry Pi v8, Raspberry Pi
ii linux-image-6.12.62+rpt-rpi-2712 1:6.12.62-1+rpt1 arm64 Linux 6.12 for Raspberry Pi 2712, Raspberry Pi
ii linux-image-6.12.62+rpt-rpi-v8 1:6.12.62-1+rpt1 arm64 Linux 6.12 for Raspberry Pi v8, Raspberry Pi
hi linux-image-6.12.75+rpt-rpi-2712 1:6.12.75-1+rpt1 arm64 Linux 6.12 for Raspberry Pi 2712, Raspberry Pi
hi linux-image-6.12.75+rpt-rpi-v8 1:6.12.75-1+rpt1 arm64 Linux 6.12 for Raspberry Pi v8, Raspberry Pi
rc linux-image-6.18.29+rpt-rpi-2712 1:6.18.29-1+rpt1 arm64 Linux 6.18.29 for Raspberry Pi 2712, Raspberry Pi
rc linux-image-6.18.29+rpt-rpi-v8 1:6.18.29-1+rpt1 arm64 Linux 6.18.29 for Raspberry Pi v8, Raspberry Pi
rc linux-image-rpi-2712 1:6.18.29-1+rpt1 arm64 Linux for Raspberry Pi 2712 (meta-package)
rc linux-image-rpi-v8 1:6.18.29-1+rpt1 arm64 Linux for Raspberry Pi v8 (meta-package)
ii raspberrypi-archive-keyring 2025.1+rpt1 all OpenPGP archive certificates of the Debian archive
ii raspberrypi-net-mods 1.4.4 all Network configuration for the Raspberry Pi UI
ii raspberrypi-sys-mods 1:20260315 arm64 System tweaks for the Raspberry Pi
rc raspberrypi-ui-mods 1.20250506 arm64 Config to customise the LXDE UI for the Raspberry Pi
ii raspi-config 20260303 all Raspberry Pi configuration tool
ii raspi-config-core 20260303 all Raspberry Pi configuration tool (script only)
ii raspi-firmware 1:1.20260513-1 all Raspberry Pi family GPU firmware and bootloaders
ii raspi-gpio 0.20231127 arm64 Dump the state of the BCM270x GPIOs
ii raspi-utils 20260304+1-1 all Collection of scripts and simple applications
ii raspi-utils-core 20260304+1-1 arm64 Collection of scripts and simple applications
ii raspi-utils-dt 20260304+1-1 arm64 Device Tree overlay utilities
ii raspi-utils-eeprom 20260304+1-1 arm64 Tools for creating and managing EEPROMs for HAT+ and HAT board
ii raspi-utils-otp 20260304+1-1 all Tools for reading and setting Raspberry Pi OTP bits
ii raspinfo 20260304+1-1 all Prints information about the Raspberry Pi for bug reports
ii rc-gui 2.14 arm64 GUI for raspi-config
ii rpi-eeprom 28.17-1 all Raspberry Pi 4/5 boot EEPROM updater
ii rpi-update 20230904 all Raspberry Pi firmware updating tool
===== docker version =====
Client: Docker Engine - Community
Version: 29.4.3
API version: 1.54
Go version: go1.26.2
Git commit: 055a478
Built: Wed May 6 17:07:08 2026
OS/Arch: linux/arm64
Context: default

Server: Docker Engine - Community
Engine:
Version: 29.4.3
API version: 1.54 (minimum version 1.40)
Go version: go1.26.2
Git commit: 56be731
Built: Wed May 6 17:07:08 2026
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: v2.2.3
GitCommit: 77c84241c7cbdd9b4eca2591793e3d4f4317c590
runc:
Version: 1.3.5
GitCommit: v1.3.5-0-g488fc13e
docker-init:
Version: 0.19.0
GitCommit: de40ad0
===== docker networks =====
NETWORK ID NAME DRIVER SCOPE
a8f0e93b7ada bridge bridge local
a01eca74483c gluetun_default bridge local
b68393f65c0b host host local
77681dffca02 none null local
1576c9e10570 watchtower_default bridge local
===== ip route =====
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.10 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
172.19.0.0/16 dev br-1576c9e10570 proto kernel scope link src 172.19.0.1
172.20.0.0/16 dev br-a01eca74483c proto kernel scope link src 172.20.0.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10 metric 100
===== ip brief addr =====
lo UNKNOWN 127.0.0.1/8
eth0 UP 192.168.1.10/24
wlan0 DOWN
docker0 UP 172.17.0.1/16
br-a01eca74483c UP 172.20.0.1/16
br-1576c9e10570 UP 172.19.0.1/16
veth449e4a0@if2 UP
veth46f1599@if2 UP
veth0d150fd@if2 UP
vethd98f061@if2 UP
veth5156237@if2 UP
veth481dd48@if2 UP

[popcornmix]

Does this help: #7365 (comment)

[MacFlurry]

I can reproduce what looks like the same regression on a Raspberry Pi 4, but without Docker installed.

Environment:

• Raspberry Pi 4 Model B Rev 1.2
• Debian GNU/Linux 13 / trixie, arm64
• Ethernet via eth0 / bcmgenet
• No Docker installed, no docker0/br-/veth interfaces
• Pi-hole + Unbound running
• Kernel upgraded by apt to: 6.18.29+rpt-rpi-v8

Observed on 6.18.29+rpt-rpi-v8:

• SSH became extremely slow and eventually unreachable, requiring a reboot.
• eth0 stayed nominally up at 1Gbps/Full, with no repeated Link Down/Up events after boot.
• Latency from the Pi to the router became extremely high but without packet loss.

Example measurement on 6.18.29:

ping -c 50 -i 0.2 192.168.25.1
50 packets transmitted, 50 received, 0% packet loss
rtt min/avg/max/mdev = 8.488/423.449/1027.859/220.077 ms

I then forced boot back to 6.12.75+rpt-rpi-v8 on the same hardware, same cable, same router, same network.

Result on 6.12.75+rpt-rpi-v8:

ping -c 50 -i 0.2 192.168.25.1
50 packets transmitted, 50 received, 0% packet loss
rtt min/avg/max/mdev = 0.144/0.189/0.415/0.038 ms

I also tested dtparam=eee=off on 6.18.29, but it did not resolve the high latency in my case. On 6.12.75, both with EEE disabled and with dtparam=eee=off commented out again, latency remains normal.

So this does not appear to require Docker/veth/bridge networking to reproduce. The key difference in my test is only the active kernel: 6.18.29 bad
kernel: 6.12.75 good.

[jmnovak50]

Additional data point:

eth0 currently has Energy Efficient Ethernet enabled and active:

ethtool --show-eee eth0

EEE settings for eth0:
EEE status: enabled - active
Tx LPI: disabled
Supported EEE link modes: 100baseT/Full
1000baseT/Full
Advertised EEE link modes: 100baseT/Full
1000baseT/Full
Link partner advertised EEE link modes: 100baseT/Full
1000baseT/Full

Given the similar report in #7365 where eth0 connectivity dies on RPi4 with 6.18.29, I am wondering whether this could be an RPi4 eth0/bcmgenet/EEE regression rather than a Docker-specific issue.

I am going to test with EEE disabled:

sudo ethtool --set-eee eth0 eee off

[jmnovak50]

Nope....I tested under 6.18.29 with EEE disabled. Still getting locked out. Strange though stays stable when under no load....the minute there is a load it locks out.

[jmnovak50]

After retesting 6.18.29 with EEE not active, clean eth0 counters, low conntrack usage, and NetworkManager configured to ignore Docker veth/bridge interfaces, the RPi4 still froze / became unreachable under the normal workload.

The same system remains stable after reverting the active boot kernel/initramfs to 6.12.75+rpt-rpi-v8.

This now looks less like EEE, NetworkManager, or conntrack exhaustion, and more like a 6.18.29+rpt-rpi-v8 kernel regression triggered by this workload.