CVE-2026-16445 Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
Remote attackers can execute arbitrary root commands during boot via malicious DHCP options in dracut's NetworkManager initrd module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-16445?
CVE-2026-16445 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 21 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
Weakness: CWE-78
Which versions are affected by CVE-2026-16445?
Linux distribution packages (9)
dracut Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-caps Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-config-generic Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-config-rescue Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-live Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-network Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-squash Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut-tools Red Hat:hummingbird:1 | All versions | 0:109-7.hum1 |
dracut openSUSE:Tumbleweed | All versions | 112+suse.47.gec0b378-1.1 |
How do I fix CVE-2026-16445?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-16445 being exploited?
There is no known exploitation of CVE-2026-16445 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-16445, GHSA-4672-282m-8fgr, OESA-2026-3300, OESA-2026-3301, RHSA-2026:40700, UBUNTU-CVE-2026-16445 and 1 more.