A flaw in dracut’s NetworkManager‑based initrd network module allows a remote attacker on an adjacent network to supply malicious DHCP options such as root‑path, next‑server, or bootfile. These options are written directly into a temporary shell script without proper escaping, creating a command‑injection point that can be exploited to run any command with root privileges inside the initramfs during boot. The weakness is identified as CWE‑78 and effectively breaks the entire system integrity guarantee during the critical boot phase.

The vulnerability applies to Red Hat distributions including Red Hat Enterprise Linux 6, 7, 8, 9, 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. Any installation that uses dracut’s NetworkManager initrd network module is susceptible, and the issue is addressed in the Red Hat patches listed in the advisories.

The CVSS score of 7.5 denotes high severity while the EPSS of 3% suggests a low likelihood of broad exploitation. The vulnerability is not listed in CISA’s KEV catalog. A remote attacker must control the DHCP server on the same local network and send crafted options before the target system completes its boot sequence. Though the window of opportunity is limited to the initramfs stage, the ability to execute arbitrary code with root privileges makes the risk significant for systems that accept DHCP offers from untrusted sources during startup.