CVE-2026-10805

Summary

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description (MUD) URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL, provided an administrator has explicitly configured NetworkManager to use dhclient. This issue does not affect default configurations of NetworkManager.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 81:1.40.16-21.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 81:1.40.16-21.el8_10 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support1:1.30.0-19.el8_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On1:1.30.0-19.el8_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support1:1.36.0-18.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On1:1.36.0-18.el8_6.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service1:1.40.16-10.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions1:1.40.16-10.el8_8.1 < *unaffected
Red HatRed Hat Enterprise Linux 91:1.54.3-5.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 91:1.54.3-5.el9_8 < *unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions1:1.42.2-32.el9_2.1 < *unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions1:1.46.0-38.el9_4.1 < *unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support1:1.52.0-11.el9_6.1 < *unaffected

Weaknesses

  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Workarounds

To prevent exploitation, ensure NetworkManager is not configured to use the dhclient backend. The default configuration on Red Hat Enterprise Linux does not enable dhclient. If a custom configuration file, such as /etc/NetworkManager/conf.d/00-dhcp.conf, contains [main] dhcp=dhclient, remove or comment out this line. After modifying the configuration, restart the NetworkManager service: sudo systemctl restart NetworkManager Warning: Restarting the NetworkManager service will temporarily disrupt network connectivity.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References