CVE-2026-16445: dracut NetworkManager RCE Vulnerability

CVE-2026-16445 Overview

CVE-2026-16445 is a command injection vulnerability [CWE-78] in dracut, the initramfs infrastructure used by Red Hat Enterprise Linux and other distributions. The flaw exists in the NetworkManager-based initrd network module. An attacker on the adjacent network can supply crafted Dynamic Host Configuration Protocol (DHCP) options such as root-path, next-server, or bootfile-name. These values are written into a temporary shell script without escaping. When the script executes during boot, the injected commands run as root inside the initramfs.

Critical Impact

A rogue DHCP server on the local network segment can achieve root code execution inside the initramfs during system boot, before the operating system fully starts.

Affected Products

• Red Hat Enterprise Linux systems using dracut with the 35network-manager module
• Systems booting with NetworkManager-based initrd network configuration
• Distributions shipping affected versions of dracut prior to commit e509c63

Discovery Timeline

• 2026-07-21 - CVE-2026-16445 published to the National Vulnerability Database (NVD)
• 2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-16445

Vulnerability Analysis

The vulnerability resides in the 35network-manager dracut module, which configures networking during early boot. When a system requests a DHCP lease, the NetworkManager helper writes received options into /tmp/dhclient."$ifname".dhcpopts. This file is subsequently sourced or interpreted as a shell script. Because DHCP option values are not escaped or quoted, an attacker who controls a DHCP response can inject arbitrary shell metacharacters into the file.

The injected payload executes with root privileges inside the initramfs. This position precedes disk encryption unlock, kernel module loading, and any userspace security controls. An attacker can therefore modify the root filesystem, plant persistence, or capture credentials before the operating system boots.

Root Cause

The root cause is improper neutralization of special elements used in shell commands [CWE-78]. DHCP option strings including root-path, next-server, and bootfile-name originate from an untrusted network peer. The 35network-manager module treats them as trusted shell content and concatenates them into an executable script.

Attack Vector

Exploitation requires network adjacency, typically a Layer 2 broadcast domain shared with the victim. The attacker operates a rogue DHCP server or races the legitimate one. When the victim boots or renews its lease, the malicious DHCP response is written to disk and processed by the initramfs shell.

The upstream fix in dracut commit e509c63 changes the interpreter for nm-run.sh from /bin/sh to /bin/bash and adds bash as an explicit module dependency to enable safer content handling.

 # called by dracut
 depends() {
-    echo dbus
+    echo dbus bash
     return 0
 }

-#!/bin/sh
+#!/bin/bash
 
 type source_hook > /dev/null 2>&1 || . /lib/dracut-lib.sh

Source: GitHub Dracut Commit e509c63

Detection Methods for CVE-2026-16445

Indicators of Compromise

• Presence of shell metacharacters such as backticks, $(...), or semicolons inside /tmp/dhclient.*.dhcpopts files captured from initramfs
• Unexpected DHCP servers responding on VLANs where only known infrastructure should be authoritative
• DHCP option 17 (root-path), option 66 (next-server), or option 67 (bootfile-name) values containing shell syntax rather than paths or hostnames

Detection Strategies

• Inspect boot logs and journal entries for anomalous processes spawned by nm-run.sh or NetworkManager helper scripts during early boot
• Monitor network segments for unauthorized DHCP OFFER or ACK packets, particularly those populating options 17, 66, or 67 with unusual values
• Compare installed dracut package versions against the fixed builds shipped in Red Hat advisories RHSA-2026:26534 and RHSA-2026:40700

Monitoring Recommendations

• Enable DHCP snooping on managed switches to drop unauthorized DHCP server responses at the port level
• Forward DHCP server and client logs to a centralized log platform and alert on unexpected server identifiers
• Track outbound connections initiated during early boot that predate normal userspace services

How to Mitigate CVE-2026-16445

Immediate Actions Required

• Apply the dracut package updates from Red Hat Security Advisory RHSA-2026:26534 and Red Hat Security Advisory RHSA-2026:40700
• Regenerate the initramfs after patching with dracut -f so the fixed 35network-manager module is embedded in the boot image
• Audit provisioning networks for unauthorized DHCP servers and enforce DHCP snooping on access switches

Patch Information

The upstream fix is available in dracut commit e509c63, which ensures safe content handling of /tmp/dhclient."$ifname".dhcpopts. Red Hat has shipped the corrected packages in RHSA-2026:26534 and RHSA-2026:40700. Refer to the Red Hat CVE Analysis for CVE-2026-16445 for distribution-specific package versions.

Workarounds

• Disable the NetworkManager-based initrd network module and rely on static IP configuration burned into the initramfs where DHCP is not required at boot
• Restrict DHCP traffic to trusted VLANs and enable DHCP snooping with authorized-server allowlists
• Boot from local disk without network initialization for systems that do not require iSCSI, NFS root, or PXE-driven storage

# Example: rebuild initramfs after applying the dracut update
sudo dnf update dracut
sudo dracut -f --regenerate-all

# Example: verify the 35network-manager module version
lsinitrd /boot/initramfs-$(uname -r).img | grep 35network-manager