CVE-2026-16445 — Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Description (CNA)

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Enterprise Linux 8	unaffected 0:049-244.git20260529.el8_10 before *
Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 0:049-138.git20220131.el8_4.1 before *
Red Hat / Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	unaffected 0:049-138.git20220131.el8_4.1 before *
Red Hat / Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	unaffected 0:049-203.git20220511.el8_6.1 before *
Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	unaffected 0:049-203.git20220511.el8_6.1 before *
Red Hat / Red Hat Enterprise Linux 8.8 Telecommunications Update Service	unaffected 0:049-223.git20230119.el8_8.1 before *
Red Hat / Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	unaffected 0:049-223.git20230119.el8_8.1 before *
Red Hat / Red Hat Hardened Images	unaffected 109-7.hum1 before *
Red Hat / Red Hat Enterprise Linux 10	unaffected
Red Hat / Red Hat Enterprise Linux 6	unaffected
Red Hat / Red Hat Enterprise Linux 7	unaffected
Red Hat / Red Hat Enterprise Linux 9	unaffected
Red Hat / Red Hat OpenShift Container Platform 4	affected

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.