A flaw in dracut’s NetworkManager‑based initrd network module allows a remote attacker on an adjacent network to supply malicious DHCP options such as root‑path, next‑server, or bootfile. These options are written directly into a temporary shell script without proper escaping, creating a command‑injection point that can be exploited to run any command with root privileges inside the initramfs during boot. The weakness is identified as CWE‑78 and effectively breaks the entire system integrity guarantee during the critical boot phase.

The vulnerability applies to Red Hat Enterprise Linux 6, 7, 8, 9, 10 and the associated support services such as Advanced Mission Critical Update Support and Extended Update Support Long‑Life Add‑On for RHEL 8.4, 8.6, 8.8, as well as the RHEL 8 Telecommunications Update Service and RHEL 8 Update Services for SAP Solutions, the Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Any installation that uses dracut’s NetworkManager initrd network module is vulnerable, and the issue is addressed in the Red Hat patches listed in the advisories.

The CVSS score of 7.5 denotes high severity while the EPSS of 3% suggests a very low likelihood of broad exploitation. The vulnerability is not listed in CISA’s KEV catalog. A remote attacker must control the DHCP server on the same local network and send crafted options before the target system completes its boot sequence. Though the window of opportunity is limited to the initramfs stage, the ability to execute arbitrary code with root privileges makes the risk significant for systems that accept DHCP offers from untrusted sources during startup.