CVE-2026-15816

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

State: Published
Severity: 7.5 High
Published: Aug 7, 2026
Updated: Nov 2, 2026
Reserved: Jul 15, 2026

Description

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:107-9.el10_2 and laterNot affected
Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat	0:105-4.el10_0.1 and laterNot affected
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRed Hat	0:004-413.el6_10 and laterNot affected
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRed Hat	0:004-414.el6_10 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat	0:033-577.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat	0:049-246.git20260728.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat	0:049-138.git20220131.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-OnRed Hat	0:049-138.git20220131.el8_4.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat	0:049-203.git20220511.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-OnRed Hat	0:049-203.git20220511.el8_6.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Telecommunications Update ServiceRed Hat	0:049-223.git20230119.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 8.8 Update Services for SAP SolutionsRed Hat	0:049-223.git20230119.el8_8.1 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:057-120.git20260728.el9_8 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:057-120.git20260728.el9_8 and laterNot affected
Red Hat Enterprise Linux 9.2 Update Services for SAP SolutionsRed Hat	0:057-25.git20250717.el9_2.2 and laterNot affected
Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat	0:057-54.git20250423.el9_4.3 and laterNot affected
Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat	0:057-89.git20250311.el9_6.1 and laterNot affected
Red Hat OpenShift Container Platform 4.12Red Hat	412.86.202610250235-0 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat	413.92.202609080414-0 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	414.92.202609011250-0 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	415.92.202609140326-0 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	416.94.202609011112-0 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	417.94.202609191027-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	418.94.202609031320-0 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	418.94.202609171815-0 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	4.19.9.6.202609021231-0 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	4.20.9.6.202608260604-0 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	4.21.9.6.202609021100-0 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	4.22.9.8.202608251819-0 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	4.22.9.8.202609081748-0 and laterNot affected
Red Hat Hardened ImagesRed Hat
Red Hat OpenShift Container Platform 5Red Hat

References

RHSA-2026:54571vendor-advisory
RHSA-2026:54575vendor-advisory
RHSA-2026:54576vendor-advisory
RHSA-2026:57580vendor-advisory
RHSA-2026:57772vendor-advisory
RHSA-2026:57775vendor-advisory
RHSA-2026:57785vendor-advisory
RHSA-2026:60440vendor-advisory
RHSA-2026:60445vendor-advisory
RHSA-2026:61252vendor-advisory
RHSA-2026:62269vendor-advisory
RHSA-2026:62409vendor-advisory
RHSA-2026:62549vendor-advisory
RHSA-2026:63041vendor-advisory
RHSA-2026:63044vendor-advisory
RHSA-2026:65839vendor-advisory
RHSA-2026:65851vendor-advisory
RHSA-2026:66357vendor-advisory
RHSA-2026:67857vendor-advisory
RHSA-2026:69118vendor-advisory
RHSA-2026:69119vendor-advisory
RHSA-2026:70586vendor-advisory
RHSA-2026:70615vendor-advisory
RHSA-2026:74499vendor-advisory
RHSA-2026:79114vendor-advisory
RHSA-2026:90272vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-15816vdb-entry
https://bugzilla.redhat.com/show_bug.cgi?id=2459963
RHBZ#2500889issue-tracking
https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh
https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.