Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Red Hat Linux boot can be hijacked via DHCP

CVE-2026-16445 · published 3 months ago
Summary

Systems running Red Hat Enterprise Linux 6, 8, 9, 10, or the hardened images use a component called dracut during the early boot stage. An attacker on the same local network can send specially crafted DHCP information that tricks dracut into running their commands with full system privileges before the operating system fully starts. Update the dracut package to the latest version provided by Red Hat or apply the recommended security patch to stop this behavior.

What to do
  • Update debian dracut to version 112-1.
  • Update canonical dracut to version 051-1ubuntu0.1~esm1.
Affected software
Ecosystem VendorProductAffected versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat hardened images All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat openshift container platform 4 All versions
Debian:11 debian dracut All versions
Debian:12 debian dracut All versions
Debian:13 debian dracut All versions
Debian:14 debian dracut < 112-1
Fix: upgrade to 112-1
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
Ubuntu:16.04:LTS canonical dracut All versions
Ubuntu:Pro:22.04:LTS canonical dracut < 051-1ubuntu0.1~esm1
Fix: upgrade to 051-1ubuntu0.1~esm1
– red hat red hat enterprise linux 8.4 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.4 extended update support long-life add-on All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 extended update support long-life add-on All versions
– red hat red hat openshift container platform 4.12 All versions
Original advisory text
Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Sources
CVE-2026-16445 · NVD
CVE-2026-16445 · MITRE
DEBIAN-CVE-2026-16445 · OSV
CVE-2026-16445 · OSV
UBUNTU-CVE-2026-16445 · OSV
Track software like this
Free during beta