CVE-2026-16445 is a command injection vulnerability in dracut's NetworkManager-based initrd network module. An attacker on the adjacent network can provide malicious DHCP options such as root-path, next-server, or bootfile name. These options are improperly escaped and injected into a temporary shell script executed during system boot, allowing root code execution within the initramfs environment. The vulnerability is related to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation results in root-level code execution during the system boot process within the initramfs environment. This compromises system integrity and could allow an attacker to control the affected system from early boot stages. The CVSS vector indicates high impact on confidentiality, integrity, and availability, but exploitation requires network adjacency and high attack complexity.

Red Hat has released security updates addressing this vulnerability for Red Hat Enterprise Linux 8 and Red Hat Hardened Images RPMs. Users should apply the official patches as described in Red Hat advisories RHSA-2026:26534 and RHSA-2026:40700. Patch status is confirmed as official-fix available. No alternative mitigations are indicated by the vendor.