Skip to main content

dracut CVE-2026-16445

| EUVDEUVD-2026-46253 HIGH
OS Command Injection (CWE-78)
2026-07-21 secalert@redhat.com GHSA-4672-282m-8fgr
RCE Command Injection
7.5
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.5 HIGH
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Adjacent DHCP position (AV:A) and boot-time race plus non-default network-initrd requirement (AC:H); no auth (PR:N) but full root code execution in initramfs yields C:H/I:H/A:H.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 21, 2026 - 13:31 vuln.today
Analysis Generated
Jul 21, 2026 - 13:31 vuln.today
CVE Published
Jul 21, 2026 - 13:17 nvd
HIGH 7.5

DescriptionCVE.org

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

AnalysisAI

Root command injection in dracut's NetworkManager-based initrd network module allows an adjacent-network attacker to execute arbitrary code inside the initramfs during early boot. By answering a booting system's DHCP request with malicious root-path, next-server, or bootfile-name options, the attacker's payload is written unescaped into a temporary shell script and executed as root before the real OS starts. No public exploit is identified at time of analysis, and the flaw is not on CISA KEV, but a Red Hat advisory (RHSA-2026:26534) and upstream fix commit confirm the issue is real and patched.

Technical ContextAI

dracut is the initramfs (early-boot RAM filesystem) generator used across RPM-based Linux distributions such as RHEL, Fedora, and SUSE. The affected component is the 35network-manager module (modules.d/35network-manager/nm-run.sh), which brings up networking in the initrd and processes DHCP lease data that NetworkManager stores as GKeyFile-format state files under /run/NetworkManager. The original code used a sed one-liner to copy DHCP option values (root-path, next-server) into /tmp/dhclient.<ifname>.dhcpopts, a file later sourced as a shell script. Because attacker-controlled DHCP string values were written without shell escaping, this is a classic CWE-78 OS Command Injection: untrusted input crosses into a shell interpretation context. The fix rewrites nm-run.sh to run under bash and introduces kf_get_string/kf_unescape/kf_parse helpers that use printf '%q' to safely quote values before they are emitted, plus adds bash as a module dependency.

RemediationAI

Apply the vendor-released patch for your distribution: on Red Hat systems install the dracut update from RHSA-2026:26534 (https://access.redhat.com/errata/RHSA-2026:26534) and then rebuild the initramfs (e.g. dracut -f / regenerate all initrds) so the corrected 35network-manager module is actually baked into the boot image - patching the package alone is insufficient until initrds are regenerated. The upstream fix is dracut commit e509c638e6 (https://github.com/dracutdevs/dracut/commit/e509c638e6), which adds safe GKeyFile parsing with printf '%q' quoting. Where patching must be deferred, the highest-value compensating control is to avoid or remove the NetworkManager-based initrd network module (rebuild the initramfs without early-boot DHCP networking) for hosts that do not require network boot - trade-off: this breaks PXE/iSCSI/NFS-root and remote-unlock workflows. Additional controls: restrict which DHCP servers clients trust and enforce DHCP snooping / rogue-DHCP protection on access switches to prevent an adjacent attacker from answering boot-time DHCP requests, accepting the operational overhead of switch configuration.

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-16445 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy