Command Injection Vulnerability in Dracut NetworkManager Module
CVE-2026-16445
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 21 July 2026
What is CVE-2026-16445?
A command injection vulnerability exists in the Dracut's NetworkManager-based initrd network module, where a remote attacker on an adjacent network can exploit improperly handled DHCP options. By sending maliciously crafted values, such as an incorrect root-path or next-server, to the affected system, attackers can manipulate a temporary shell script. This leads to the potential for root code execution within the initramfs during system boot, making this a significant security risk that necessitates immediate attention.
Affected Version(s)
Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10
Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved