If you're here, you're probably in a hurry, so here are the steps.
Boot into your installation
When it hightlights the default choice, hit e as in edit and hit
enter
This takes you to a screen where you can edit the grub entry.
Choose the line beginning with linux. In there you'll see ro, as in
read only, change that ro to rw as in read write. At the end of that
same Linux line, put in
init=/bin/bash |
Hit ctl+x to boot with the edited linux line. It will boot into a
root prompt, no password is required.
Type
passwd |
to set a new root password. It will ask you to type it again to confirm.
Now type
touch /.autorelabel exec /sbin/init |
Hit enter and it will show that it's relabling SELinux contexts on the screen. It will then reboot. When it gets to the login the new root password that you set will work.
There is another well-known method where you add rd.break to the linux line, but it's a little more complex, though not terribly so, where you have to remount /sysroot with rw and chroot to sysroot. The first method seems simpler to me.
This works with RHEL8 and 9. According to this bug report the documented RedHat fix doesn't work with RHEL9, though they may fix it by the time you read this. The way given above works for both RHEL8 and 9, as well as its clones, such as Alma, Rocky, and CentOS.
I don't know if the touch /.autorelabel is needed if you don't have SELinux running, but, as SELinux gets easier and easier to use, I didn't test without it.
As you'll note if you look at the bug report, the method I give is the solution given by Mr. Filipek. I take no credit for it, I have it here mostly so that I can find it quickly if I need it.
For completeness, the method given by RedHat is
rd.break |
Then hit ctl+X. The system will boot to a root prompt. At that point, chroot to /sysroot and remount it read/write.
chroot /sysroot mount -o remount,rw / |
Now you can run the passwd command to reset the root password. Then type
touch .autorelabel |
Now type exit to get out of chroot and exit a second time. The second "exit" will start the autorelabel which can take some time. The system will then return to a functional state with a new root password.