CVE-2026-16445
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
A command injection vulnerability in dracut. A remote attacker on the adjacent network can provide crafted DHCP options, leading to code execution in initramfs during system boot.
Risk Assessment
Risk of remote code execution with root privileges in initramfs during boot, potentially allowing persistent system compromise.
Recommendation
Upgrade dracut to a patched version.
Other vulnerabilities in dracut
See all- CVE-2026-15816High
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
- CVE-2026-6893High
A flaw in dracut allows a remote attacker on the adjacent network to inject commands via specially crafted DHCP options (e.g., a malicious hostname). These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. The attacker can achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Original NVD description (English source)
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.