CVE-2026-16445
Received Received - Intake

Command Injection in Dracut via DHCP Options

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16445
EUVD
EUVD-2026-46253

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
redhat dracut *
dracutdevs dracut *
redhat dracut From 2026-04-01 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in dracut allows a remote attacker on the same network to execute arbitrary commands with root privileges during system boot. It occurs when specially crafted DHCP options like root-path or bootfile name are processed by dracut's NetworkManager-based initrd network module. The values are written to a temporary shell script without proper escaping, enabling command injection when the script is executed as root in the initramfs environment.

Detection Guidance

To detect this vulnerability, check if your system uses dracut's NetworkManager-based initrd network module. Inspect DHCP lease files in /run/NetworkManager/devices for suspicious values in options like root-path, next-server, or dhcp-bootfile. Look for unescaped shell metacharacters in temporary .dhcpopts files generated during boot.

Impact Analysis

An attacker could gain full control over your system during boot, allowing them to install malware, steal data, or disrupt operations. Systems using dracut with NetworkManager-based initrd network modules and DHCP-derived netroot are vulnerable. Exploitation requires only adjacent network access via a malicious DHCP server.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially violating data protection requirements under GDPR or HIPAA. Compromise of system integrity during boot may result in unauthorized data access, modification, or exfiltration, triggering compliance violations and regulatory penalties.

Mitigation Strategies

Apply the latest dracut update immediately. If an update is unavailable, disable the NetworkManager initrd network module by removing or renaming the module file in /usr/lib/dracut/modules.d/. Ensure DHCP servers on your network are trusted and do not provide malicious options.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16445. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart