Skip to content
Fencer Vulns
high 7.5

CVE-2026-16445 json

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

published 2026-07-21 3 mo ago modified 2026-11-04 4 d ago also EUVD-2026-46253

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:049-203.git20220511.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:049-203.git20220511.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202610250235-0
  • Red Hat Red Hat Hardened Images 109-7.hum1
  • dracut Debian 14 112-1

debian advisories DEBIAN-CVE-2026-16445

  • dracut Ubuntu Pro 22.04 LTS 051-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-16445

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dracut hummingbird 1 109-7.hum1
  • dracut-caps hummingbird 1 109-7.hum1
  • dracut-live hummingbird 1 109-7.hum1
  • dracut-tools hummingbird 1 109-7.hum1
  • dracut-squash hummingbird 1 109-7.hum1
  • dracut-network hummingbird 1 109-7.hum1
  • dracut-config-rescue hummingbird 1 109-7.hum1
  • dracut-config-generic hummingbird 1 109-7.hum1

red hat advisories RHSA-2026:69119RHSA-2026:69118RHSA-2026:61252RHSA-2026:40700RHSA-2026:26534

  • dracut SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 055+suse.408.g34171a9-150500.3.47.1
  • dracut SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 055+suse.371.g92f67c2-150400.3.55.1
  • dracut SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE High Availability Extension 15 SP6 059+suse.571.g3d42218af-150600.3.35.1
  • dracut SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 059+suse.730.g73d3411aa-160000.1.1
  • dracut SLE Module for Basesystem 15 SP7, SLE High Availability Extension 15 SP7 059+suse.576.g72b98359a-150700.3.23.1
  • dracut Linux Micro 6.0 059+suse.615.g018c5a4-1.1
  • dracut Linux Micro 6.1 059+suse.649.g0274006-slfo.1.1_1.1

suse advisories SUSE-SU-2026:4079-1SUSE-SU-2026:4078-1SUSE-SU-2026:3997-1SUSE-SU-2026:23466-1SUSE-SU-2026:23614-1SUSE-SU-2026:3931-1

  • dracut openSUSE Leap 16.0 059+suse.730.g73d3411aa-160000.1.1
  • dracut openSUSE Tumbleweed 112+suse.47.gec0b378-1.1

opensuse advisories openSUSE-SU-2026:21749-1openSUSE-SU-2026:11657-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-16445 updated cvss 7.5

dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module

  • Red Hat Enterprise Linux BaseOS (v. 8) dracut 049-244.git20260529.el8_10, dracut-caps 049-244.git20260529.el8_10, dracut-live 049-244.git20260529.el8_10, dracut-tools 049-244.git20260529.el8_10, dracut-squash 049-244.git20260529.el8_10, dracut-network 049-244.git20260529.el8_10, +2 more
    fixed: vendor fix RHSA-2026:26534
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) dracut 049-138.git20220131.el8_4.1, dracut-caps 049-138.git20220131.el8_4.1, dracut-live 049-138.git20220131.el8_4.1, dracut-tools 049-138.git20220131.el8_4.1, dracut-squash 049-138.git20220131.el8_4.1, dracut-network 049-138.git20220131.el8_4.1, +2 more
    fixed: vendor fix RHSA-2026:69118
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) dracut 049-203.git20220511.el8_6.1, dracut-caps 049-203.git20220511.el8_6.1, dracut-live 049-203.git20220511.el8_6.1, dracut-tools 049-203.git20220511.el8_6.1, dracut-squash 049-203.git20220511.el8_6.1, dracut-network 049-203.git20220511.el8_6.1, +2 more
    fixed: vendor fix RHSA-2026:69119
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-network 049-223.git20230119.el8_8.1
    fixed: vendor fix RHSA-2026:61252
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) dracut 049-138.git20220131.el8_4.1, dracut-caps 049-138.git20220131.el8_4.1, dracut-live 049-138.git20220131.el8_4.1, dracut-tools 049-138.git20220131.el8_4.1, dracut-squash 049-138.git20220131.el8_4.1, dracut-network 049-138.git20220131.el8_4.1, +2 more
    fixed: vendor fix RHSA-2026:69118
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) dracut 049-203.git20220511.el8_6.1, dracut-caps 049-203.git20220511.el8_6.1, dracut-live 049-203.git20220511.el8_6.1, dracut-tools 049-203.git20220511.el8_6.1, dracut-squash 049-203.git20220511.el8_6.1, dracut-network 049-203.git20220511.el8_6.1, +2 more
    fixed: vendor fix RHSA-2026:69119
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-network 049-223.git20230119.el8_8.1
    fixed: vendor fix RHSA-2026:61252
  • Red Hat Hardened Images dracut 109-7.hum1, dracut-caps 109-7.hum1, dracut-live 109-7.hum1, dracut-tools 109-7.hum1, dracut-squash 109-7.hum1, dracut-network 109-7.hum1, +2 more
    fixed: vendor fix RHSA-2026:40700
show 2 more
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202610250235
    fixed: vendor fix RHSA-2026:90272
  • Red Hat Enterprise Linux 6 dracut, dracut-caps, dracut-fips, dracut-tools, dracut-kernel, dracut-generic, +2 more Red Hat Enterprise Linux 7 dracut, dracut-caps, dracut-fips, dracut-tools, dracut-network, dracut-fips-aesni, +2 more Red Hat Enterprise Linux 9 dracut, dracut-caps, dracut-live, dracut-tools, dracut-squash, dracut-network, +2 more Red Hat Enterprise Linux 10 dracut Red Hat Enterprise Linux BaseOS E4S (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-caps 049-223.git20230119.el8_8.1, dracut-live 049-223.git20230119.el8_8.1, dracut-tools 049-223.git20230119.el8_8.1, dracut-squash 049-223.git20230119.el8_8.1, dracut-config-rescue 049-223.git20230119.el8_8.1, +1 more Red Hat Enterprise Linux BaseOS TUS (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-caps 049-223.git20230119.el8_8.1, dracut-live 049-223.git20230119.el8_8.1, dracut-tools 049-223.git20230119.el8_8.1, dracut-squash 049-223.git20230119.el8_8.1, dracut-config-rescue 049-223.git20230119.el8_8.1, +1 more
    +1 more products
    Red Hat OpenShift Container Platform 5 dracut
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

3.22% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 5

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.