An attacker on the adjacent network can supply malicious DHCP options, such as an unwieldy hostname, to a system deploying dracut’s legacy DHCP path. These options are written into temporary shell scripts without escaping, triggering command injection and allowing the attacker to run arbitrary code as root while the system is booting. The attacker can compromise the boot process, alter network settings, and gain persistent control.

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Hardened Images, Red Hat OpenShift Container Platform 4, and the Red Hat Hummingbird 1 image.

The flaw carries a CVSS score of 7.5, classifying it as high severity. Exploitation requires an attacker to control a DHCP server on a neighbouring network segment and requires the target to use DHCP during its initramfs phase. The EPSS score is < 1%, indicating a very low but non-zero probability, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote but constrained to nearby networks, making the risk significant for systems that must boot with DHCP in potentially untrusted environments.