CVE-2026-16445 is a command injection vulnerability in dracut's NetworkManager-based initrd network module (nm-run.sh). The flaw arises because DHCP options such as root-path, next-server, or bootfile name are improperly handled and written into a temporary shell script without proper escaping. An attacker on the adjacent network acting as a DHCP server can supply malicious DHCP options that lead to command injection and root code execution within the initramfs during system boot. This affects systems using dracut's network-manager module with DHCP-derived netroot configurations, such as NFS-root setups. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Successful exploitation allows an attacker on the adjacent network to execute arbitrary commands as root during system boot within the initramfs environment. This can lead to full system compromise, including unauthorized code execution, data modification, and denial of service. The attack vector requires adjacency on the network and high attack complexity but no privileges or user interaction. The impact on confidentiality, integrity, and availability is high.

Red Hat has released updated dracut RPMs (version 109-7.hum1) that properly escape DHCP-derived values using shell-safe quoting before writing them to the generated dhcpopts file, preventing command injection. Users should apply the update from Red Hat Hardened Images RPMs as detailed in the advisory (https://access.redhat.com/errata/RHSA-2026:40700). Systems configured to boot with dracut's network-manager module using DHCP-derived netroot should be prioritized for patching. No alternative mitigations are specified beyond applying the official update.