From 7a316d9159be8a1d012cf5b431a0d13aa4b37776 Mon Sep 17 00:00:00 2001
From: Tobias Brunner <tobias@strongswan.org>
Date: Fri, 19 Jun 2026 19:28:00 +0200
Subject: [PATCH] kernel-libipsec: Remove exclude route (reference) if route is
 updated

Fixes: 587bdf87688f ("kernel-libipsec: Track policies and automatically install routes")
---
 src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
index 215eaa153..c7dee9a48 100644
--- a/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
+++ b/src/libcharon/plugins/kernel_libipsec/kernel_libipsec_ipsec.c
@@ -486,6 +486,7 @@ static bool install_route(private_kernel_libipsec_ipsec_t *this,
 				 "%R === %R %N", src_ts, dst_ts, policy_dir_names,
 				 policy->direction);
 		}
+		remove_exclude_route(this, old);
 		route_entry_destroy(old);
 		policy->route = NULL;
 	}