🚨 HIGH - DHCP option command injection in dracut initrd NetworkManager module (CVE-2026-16445) A command-injection vulnerability exists in dracut’s NetworkManager-based initrd network module, where DHCP-provided fields are incorporated into initramfs networking logic during early boot. The root cause is improper input sanitization/escaping when writing attacker-controlled DHCP options (e.g., root-path, next-server, bootfile name) into a temporary shell script. An attacker on the same/adjacent network can exploit this by serving or spoofing DHCP responses with crafted option values that get executed by the initrd scripting. Successful exploitation results in arbitrary command execution as root inside the initramfs during boot, enabling full system compromise before the OS fully loads. 👉 Affected: dracut (versions using the NetworkManager-based initrd network module; exact range TBD) | Upgrade to No fix yet - treat as suspicious
Post summary
The post announces CVE‑2026‑16445, detailing a DHCP option command injection flaw in dracut’s initrd NetworkManager module, its impact, and the lack of a current fix.
