This is not something that affects the regular functioning of your server. The only thing that affects is your ability to use VSOCK to connect to VMs from the host. If you don’t use vsock you can safely ignore this.
If you’re running Debian systemD version 257.8-1~deb13u2 or below you won’t see this error message. I have a VM running the latest 257.13-1~deb13u1 and has this error printed on the console.
The “Fix”
The “fix” is to assign a vsock CID for the Debian guest VM. If you’re not planning to use vsock, simply ignore this console error and wait for a systemD upgrade from deb repos.
In Proxmox PVE, you can assign a vsock CID by editing the file /etc/pve/qemu-server/<VM-ID>.conf and adding line: args: -device vhost-vsock-pci,id=vhost-vsock-pci0,guest-cid=<CID-value-of-your-choice>
CID value can be from 3 and higher. CID value has to be unique between the VMs so I like to basically assign the VM ID as the vsock CID so I don’t accidentally re-use it.
Also make sure your guest has SSH active and has loaded the Kernel modules required for vsock.
Restart VM after saving the edit.
So what happened with the latest Debian systemD?
According to this systemd bug report case: https://github.com/systemd/systemd/issues/42188, systemD upstream tightened vsock_get_local_cid()which checks if a VM’s vsock has received a CID from the hypervisor host.
This vsock_get_local_cid() is used by the guest’s systemd-ssh-generator to check for an assigned vsock CID and if so open an SSH socket. Ideally, if the guest is not assigned a CID, the socket creation should fail silently (during boot) without printing any error on the console.
Looks like Debian packaged this tightening change from upstream systemD without “updating the soft-fail guard in the caller” (this soft-fail guard is the one that silently fails without printing any error on console in the event of a non-assigned CID. return 0 instead of a 1).
Thus the error (-EADDRNOTAVAIL) returned from Debian’s systemd vsock_get_local_cid() fell through to the generic error handling at the bottom of the caller function (that is vsock_get_local_cid_or_warn) and prints it on console.
You can find this info here: https://github.com/systemd/systemd/issues/42188 and the code I was talking about here: https://github.com/systemd/systemd/commit/8c3acba63b40cd0ebcb9863804e598744eda0b80
