CVE-2026-16445: Dracut Command Injection via Malicious DHCP Options

A critical command injection vulnerability, identified as CVE-2026-16445, has been discovered in dracut, a Linux utility used to generate an initramfs image. This flaw specifically impacts systems utilizing dracut's NetworkManager-based initrd network module. A remote attacker on an adjacent network can exploit this vulnerability by providing maliciously crafted DHCP options, such as root-path, next-server, or bootfile name. Dracut's module improperly handles these options, writing them directly into a temporary shell script without adequate escaping, which leads to command injection. Successful exploitation grants the attacker root code execution privileges within the initramfs environment during the system's boot sequence. This vulnerability poses a significant risk as it allows for early-stage system compromise before the main operating system even fully loads, potentially enabling persistent access or full system control.

Attack Chain

1. An attacker positions themselves on the same adjacent network segment as the target Linux system, or spoofs DHCP responses.
2. The target system, configured to use dracut's NetworkManager-based initrd network module, initiates its boot sequence.
3. During the boot process, the initramfs environment attempts to obtain network configuration via DHCP.
4. The attacker's controlled or spoofed DHCP server responds to the target system's DHCP requests.
5. The DHCP response includes specially crafted options, such as root-path, next-server, or bootfile name, containing shell metacharacters or malicious commands.
6. Dracut's NetworkManager-based initrd module processes these malicious DHCP options.
7. The module writes the unescaped, attacker-controlled DHCP option values into a temporary shell script within the initramfs.
8. The temporary shell script is subsequently executed, leading to command injection and allowing the attacker to achieve root code execution within the initramfs environment.

Impact

Successful exploitation of CVE-2026-16445 allows a remote attacker to gain root code execution on affected Linux systems during the crucial initramfs stage of boot. This level of compromise grants the attacker complete control over the system before the operating system is fully loaded, enabling them to disable security mechanisms, install persistent backdoors, exfiltrate sensitive data, or render the system inoperable. As the vulnerability allows for root access, it could bypass many traditional endpoint security controls that activate later in the boot process. The full scope of victims could include any Linux system running dracut with the specified NetworkManager module exposed to an untrusted adjacent network.

Recommendation

• Patch CVE-2026-16445 immediately by updating dracut to the latest version provided by your Linux distribution vendor to address the command injection vulnerability.
• Implement strict network segmentation to limit the exposure of systems to untrusted adjacent networks, thereby reducing the attack surface for DHCP-based exploits like CVE-2026-16445.
• Monitor DHCP server logs for unusual or malformed DHCP option values, especially those containing shell metacharacters or suspicious strings that might indicate attempts to exploit CVE-2026-16445.