CVE-2026-16445 Red Hat CVE debrief

Who should care

System administrators and users of dracut, particularly those using Red Hat Enterprise Linux, should be aware of this vulnerability and take steps to mitigate it. This vulnerability is especially concerning for systems that use dracut's NetworkManager-based initrd network module and are exposed to untrusted networks.

Technical summary

The vulnerability exists in dracut's handling of DHCP options. When a system using dracut's NetworkManager-based initrd network module receives specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, they are written into a temporary shell script without proper escaping. This leads to command injection, allowing an attacker to execute arbitrary code with root privileges within the initramfs during system boot. The attack requires the attacker to be on the adjacent network and have the ability to provide malicious DHCP options.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by the vendor to fix the vulnerability
• Use secure DHCP options and validate their contents
• Implement network controls to prevent malicious DHCP options from being provided
• Monitor system logs for suspicious activity related to dracut and DHCP
• Consider using alternative initramfs tools or configurations that are not vulnerable

Evidence notes

The CVE record was published on 2026-07-21T13:17:16.730Z and was last modified on 2026-07-22T19:16:57.380Z. The NVD entry is currently Awaiting Analysis. References include Red Hat errata and bugzilla entries, as well as a GitHub commit.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.