The vulnerability in dracut arises from improper neutralization of special elements in DHCP options such as root-path, next-server, or bootfile name. When these options are processed by dracut's NetworkManager-based initrd network module, they are written into a temporary shell script without adequate escaping, enabling OS command injection. This flaw permits a remote attacker on the adjacent network to achieve root code execution during the early boot phase (initramfs) of Red Hat Enterprise Linux 8 systems. The issue is tracked as CVE-2026-16445 with a CVSS 3.1 base score of 7.5 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Red Hat has published an important security advisory (RHSA-2026:26534) providing updated dracut packages that fix this vulnerability.

Successful exploitation allows an attacker on the adjacent network to execute arbitrary commands as root during system boot, potentially leading to full system compromise. The impact includes complete confidentiality, integrity, and availability loss of the affected system. This occurs in the initramfs environment before the main system is fully operational, which can bypass many traditional runtime security controls.

Red Hat has released updated dracut packages that fix this vulnerability as detailed in advisory RHSA-2026:26534. Users of Red Hat Enterprise Linux 8 should apply these updates promptly following the instructions at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified in the advisory. Patch status: official fix available.