NetworkManager 1.58.1 dropped on August 21, 2026, primarily to fix a regression that broke automatic connections to WPA3 networks introduced in the previous release. The update enforces stricter security for private 802.1X connections by rejecting arbitrary CA paths, forcing users to rely on system-trusted certificates instead. Additionally, DNS port forwarding to systemd-resolved now works correctly, and mobile broadband interfaces finally enable IPv4 forwarding for gateway usage. While the base 1.58 release already removed dhclient support, this maintenance patch includes the final CVE-2026-10805 fix to prevent config injection in the deprecated backend.

NetworkManager 1.58.1 fixes WPA3 regression, hardens private connections, and warns about the dhclient purge

The maintenance release lands August 21, bringing stricter 802.1X certificate enforcement and DNS fixes to systemd-resolved.

NetworkManager 1.58.1 has arrived. If you've been upgrading your Linux desktop this month and noticed your WPA3 network suddenly stopped joining, this patch is the cure. The maintenance update dropped on August 21, 2026, exactly one month after the feature-heavy NetworkManager 1.58 base release.

The headline fix addresses a regression that broke SAE auto-connect for WPA3 networks. Networks using key-mgmt=wpa-psk profiles with modern WPA3 security previously failed to reconnect automatically after the 1.58 upgrade. 1.58.1 restores that behavior. Next, the security hardening gets real.

Private connections get stricter

For connections pinned to a specific user via connection.permissions, NetworkManager now rejects ca-path and phase2-ca-path properties during activation.

If your profile still tries to handpick a certificate authority path for 802.1X authentication, it will fail. You need to switch to ca-cert or system-ca-certs instead. The change prevents profile owners from pointing authentication servers toward arbitrary CA trust stores. It's a tighter lock on how user-specific profiles handle private keys and certificates.

The release also ships a fix for CVE-2026-10805, where hostnames and MUD URLs weren't validated before being written to the dhclient configuration file. Invalid characters could alter config syntax. That injection vector is closed. Keep in mind that dhclient support itself is already gone.

DNS, DHCP, and routing tweaks

DNS handling sees several precision improvements. systemd-resolved now correctly receives the port number for DNS URIs, fixing cases where non-default ports were silently dropped during configuration. NetworkManager also skips invalid nameservers when pushing config to resolved and ignores unspecified addresses coming from RDNSS and DHCPv6.

On the DHCP front, the daemon now logs a warning when it must ignore Option 3 (Router) because classless static routes from Option 121 or 249 leave the connection without a gateway. Connectivity checks also run even when an interface only has an IPv4 link-scope default route, a scenario that was previously skipped.

Mobile broadband users should note a fix for IPv4 forwarding. Modem data interfaces now enable forwarding, restoring routing for connections acting as gateways.

The dhclient death is official

NetworkManager 1.58 removed support for dhclient as a DHCP backend. It had been deprecated since version 1.50, giving users about eight months to migrate.

If your system still relies on ISC's dhclient, you're on your own. Switch to the internal DHCP client or systemd-networkd. Enterprise environments running legacy equipment that depends on dhclient's specific quirks should audit their setups now. The breaking change is complete.

What else landed in 1.58

The base release introduced a handful of features that stick around in 1.58.1. IPv6-only hosts can now use CLAT via a BPF program to reach IPv4 destinations, a response to global address exhaustion. GENEVE tunnel support rounds out the overlay networking gains.

Wi-Fi users get band property support for "6GHz", reflecting the rollout of Wi-Fi 6E and 7 hardware. nmcli scan results now display the Wi-Fi band for each access point. nmtui, the text UI, picked up Vim-style search, a QR code sharing button, and a "Rescan Wi-Fi" button on the activation screen.

The development cycle for 1.58 ran about ten weeks and included roughly 407 commits. Red Hat's Daniel Berrangé and Josephine Pfeiffer led the effort, with contributions from SUSE, Cisco, Linutronix, and the wider community.

Head here to the project's GitLab release page. If you're running WPA3, update immediately.