CVE-2026-16445: Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

A flaw was found in dracut. The NetworkManager-based initrd network module (modules.d/35network-manager/nm-run.sh) reads DHCP lease values (root-path, next-server, dhcp-bootfile) from a NetworkManager device state file and writes them into a temporary file (/tmp/dhclient.<ifname>.dhcpopts) without escaping shell metacharacters. This file is later sourced as shell code during network-root boot handling (for example, NFS-root configurations). A DHCP server reachable on the same network segment as a booting host can supply a root-path, next-server, or dhcp-bootfile option value containing shell metacharacters, which are copied verbatim into the sourced file and executed as root in the initramfs when the file is sourced. Exploitation requires an initramfs built with dracut's network-manager module, configured to boot with a DHCP-derived netroot. This is a distinct code path from CVE-2026-6893, which affects dracut's network-legacy module (dhclient-script.sh). The fix escapes DHCP-derived values using shell-safe quoting before writing them to the generated file, consistent with the approach already used in later dracut versions.

— Red Hat