NetworkManager 1.58 has shipped with GENEVE tunnel support and carrier-side CLAT/464XLAT translation, positioning the tool for modern SDN and IPv6-only infrastructure transitions. The release permanently removes the legacy dhclient DHCP backend and deprecates Wireless Extensions, forcing reliance on internal clients and modern Wi-Fi standards. Security receives a boost with certificate access verification for private connections and patches for memory safety vulnerabilities in the internal DHCPv4 client. Users also see 6GHz Wi-Fi configuration options, improved iwd backend parity, and significant usability improvements across nmcli and nmtui interfaces.

NetworkManager 1.58 lands with GENEVE tunnels, CLAT support, and the death of dhclient

The standard Linux network configuration tool just got its annual major update, and it's leaving some legacy bits behind. NetworkManager 1.58 shipped on July 20, 2026, after roughly 10 weeks of development from May through July. Red Hat's Josephine Pfeiffer handled the final release tag, with Beniamino Galvani also logging 35+ commits during the cycle.

If you're running Fedora, RHEL, openSUSE, or any distro that ships GNOME desktop, you're already using it. The tool manages everything from Wi-Fi to VPNs to virtual bridges, and this release brings some serious data center features alongside the usual polish.

New tunneling and translation features

GENEVE interface support is the headline for enterprise deployments. Generic Network Virtualization Encapsulation tunnel interfaces let NetworkManager participate in SDN overlays used in modern data centers. Not exactly a home user feature, but it closes a gap with other network stacks that already support VXLAN and similar protocols.

Carrier networks transitioning to IPv6-only backends get CLAT (464XLAT) support via BPF. A new ipv4.clat property enables carrier-side IPv4-to-IPv6 translation using a Berkeley Packet Filter program. Still disabled by default pending further testing, but it's exactly the kind of thing mobile operators need.

The internal ping implementation replaces the external ping tool dependency for gateway checks. Less process spawning, more reliability. Connection profiles with unreachable gateways now warn you at activation time instead of silently continuing. NetworkManager will eventually deprecate the auto-add behavior for on-link routes, nudging you toward proper subnet configuration.

Wi-Fi gets modern and iwd parity improves

The Wi-Fi band property now accepts 6GHz. You can explicitly configure Wi-Fi 6E and 7 access points without relying on auto-detection. The iwd backend finally gets powersave support, matching wpa_supplicant feature parity for Intel Wi-Fi devices.

WPA3-SAE password mismatches now prompt you for a retry instead of failing immediately. Typos happen. WPS provisioning accepts 64-hex-character PSKs returned by some access points. nmcli scan results show the frequency band of access points now, which is a small but useful quality-of-life improvement.

dhclient gone, Wireless Extensions deprecated

The external dhclient DHCP client has been completely removed. It was deprecated since NetworkManager 1.50, and that's the final end. The internal DHCPv4 and DHCPv6 clients are now mandatory. If you were relying on dhclient-specific features or behaviors, you'll need to adapt.

Wireless Extensions support is deprecated and disabled by default. The legacy Linux Wi-Fi API predates nl80211 and cfg80211, and it's time to move on. NetworkManager 1.58 may not work with very old Wi-Fi hardware that only supports WEXT. If you're still running a decade-old adapter, this might bite you.

The modify_system build option that allowed non-admin users to create system-wide connections has been removed entirely. It was a security concern, and that's that.

Security hardening

Certificate and key access verification now happens for private connections with user-specific permissions via connection.permissions. NetworkManager verifies that the specified user can actually access the 802.1X certificates and keys in the profile. Previously, a permission-restricted user could reference certificates they couldn't read, which was an authorization bypass.

CVE-2026-10805 addressed hostname and MUD URL validation before writing to dhclient config files. Characters that could alter config syntax are now sanitized. Note that dhclient is removed in 1.58, so this is somewhat academic, but the fix was applied before the removal.

A memory safety vulnerability in the internal DHCPv4 client has been patched. An on-link attacker could previously crash NetworkManager by sending malformed UDP packets. Not a remote exploit, but still worth fixing.

nmcli and nmtui get polish

The nmcli PORT column replaces the older SLAVE label. It adds BRIDGE.PORTS, TEAM.PORTS, and GENERAL.CONTROLLER-PATH fields for better visibility. nmtui now includes a show/hide password toggle in secret dialogs, matching nm-connection-editor.

Connection lists in nmtui support Vim-style search filtering with /. A new "Select..." button in nmtui lets you choose from available physical interfaces when creating connections. All bond options are configurable via an "other options" catch-all input. Wi-Fi credentials can be shared as QR codes via the connection editor.

IPv6 and connectivity improvements

IPv6 Prefix Delegation via DHCPv6 now considers interfaces healthy even without a non-temporary address. Delegated prefixes can be used with ipv6.method: shared. Connectivity checking now uses DNS servers defined on the same link rather than system-wide DNS, providing more accurate results.

A long-standing bug where NetworkManager could report limited connectivity even when another device had full access has been fixed. The stale state issue also resolves lingering limited connectivity reports after internet restoration.

Build and infrastructure changes

All components now consistently use -rcX or -dev suffixes throughout URLs, filenames, and nmcli output. The C API continues using the legacy 90+ numbering for RC versions as an exception. systemd generator for initramfs units replaces static placement, enabling more flexible early-boot networking.

NetworkManager 1.58 is a solid update. The GENEVE and CLAT features target enterprise and carrier deployments, which is where the tool is heading. The removal of dhclient and Wireless Extensions forces modernization, though it may break legacy hardware setups. The security hardening is welcome, especially the certificate verification.

The price of dropping legacy support is incompatibility with older Wi-Fi adapters. If you're running hardware from the early 2010s, test before upgrading. Otherwise, this is a meaningful step forward.

The release tag is at gitlab.freedesktop.org/NetworkManager/NetworkManager/-/tags/1.58.0. Distribution updates should follow in the coming weeks. Head to networkmanager.dev for documentation and the source repository at gitlab.freedesktop.org/NetworkManager/NetworkManager.