CVE-2026-16445 – Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

CVE ID :CVE-2026-16445

Published : July 21, 2026, 1:17 p.m. | 27 minutes ago

Description :A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut’s NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

Severity: 7.5 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…