Command Injection Vulnerability in Dracut NetworkManager Module
CVE-2026-16445
Key Information:
What is CVE-2026-16445?
A command injection vulnerability exists in the Dracut's NetworkManager-based initrd network module, where a remote attacker on an adjacent network can exploit improperly handled DHCP options. By sending maliciously crafted values, such as an incorrect root-path or next-server, to the affected system, attackers can manipulate a temporary shell script. This leads to the potential for root code execution within the initramfs during system boot, making this a significant security risk that necessitates immediate attention.
Affected Version(s)
Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1
References
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved