Red Hat Hummingbird

FreeType CID Font Loader Memory DoS via Repeated Allocations
CVE-2026-95512 5.5 - Medium - October 02, 2026

A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.

Resource Exhaustion

Heap Buffer Overflow in rpm via Symlink Entry Parsing
CVE-2026-95520 7.1 - High - September 29, 2026

A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker-controlled data past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package.

Memory Corruption

Command Injection via %() Macro in rpm SRPM
CVE-2026-95521 7.8 - High - September 24, 2026

A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm.

Shell injection

CVE-2026-95519: rpm manifest macro exp. allows RCE
CVE-2026-95519 7.8 - High - September 24, 2026

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account.

Shell injection

BusyBox TLS get_client_hello() OOB Read on Truncated ClientHello
CVE-2026-88840 5.3 - Medium - September 23, 2026

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message.

Out-of-bounds Read

OOB Heap Write in BusyBox passwd/group tokenize()
CVE-2026-88839 6.7 - Medium - September 23, 2026

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers.

Memory Corruption

BusyBox httpd Basic Auth Inverts Yescrypt Hash Check
CVE-2026-88837 6.5 - Medium - September 23, 2026

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

Authentication Bypass by Primary Weakness

BusyBox dpkg read_package_field() OOB Heap Read via Malformed .deb
CVE-2026-88835 6.1 - Medium - September 23, 2026

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read.

Out-of-bounds Read

BusyBox httpd IP Deny Rule Fail-Open via Invalid CIDR Prefix Length
CVE-2026-88831 5.3 - Medium - September 23, 2026

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients.

Failing Open

BusyBox romfs Volume ID Parsing Heap Buffer Overflow via Unbounded Strlen
CVE-2026-88832 7.3 - High - September 23, 2026

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images.

Memory Corruption

BusyBox TLS Heap Overflow via ClientKeyExchange (CVE-2026-88830)
CVE-2026-88830 7.5 - High - September 23, 2026

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message.

Incorrect Calculation of Buffer Size

sudo Time Window Bypass via TZ in NOTBEFORE/NOTAFTER
CVE-2026-96512 7.8 - High - September 23, 2026

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected.

AuthZ

Integer Overflow in libstdc++ New Operator Causing Memory Corruption
CVE-2026-95619 7.7 - High - September 22, 2026

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability.

Integer Overflow or Wraparound

CUPS Privilege Escalation via cupsfilters Serial Backend Path Bypass
CVE-2026-95511 - September 22, 2026

DenialofService in Poppler Splash via tilingpattern overflow
CVE-2026-93653 5.5 - Medium - September 18, 2026

A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration.

Unchecked Input for Loop Condition

libxml2 NULL Pointer Deref in XML Catalog Parsing (DoS)
CVE-2026-76781 5.5 - Medium - September 17, 2026

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

NULL Pointer Dereference

Redis Community Cluster Bus OOB Read via Unchecked Null-Termination
CVE-2026-92925 7.1 - High - September 17, 2026

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds read when the packet's payload is processed. Successful exploitation of this vulnerability could result in the disclosure of sensitive information or a remote denial of service (DoS).

Out-of-bounds Read

sequoia-openpgp Key Flag Flaw Allows Subkey Bypass & Signature Forgery
CVE-2026-42784 7.4 - High - September 16, 2026

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

Improper Verification of Cryptographic Signature

Podman tar load RCE: crafted archive writes files with user privileges
CVE-2025-11395 5.5 - Medium - September 15, 2026

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

Insecure Inherited Permissions

tftp-hpa OOB Read/Write via Malicious Inverse Remap Rule
CVE-2026-85234 7.5 - High - September 15, 2026

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Out-of-bounds Read

A flaw was found in the containers/storage library
CVE-2026-79699 4.4 - Medium - September 15, 2026

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

insecure temporary file

A flaw was found in the buildah/copier Go package
CVE-2026-79705 4.5 - Medium - September 15, 2026

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

Directory traversal

A flaw was found in environment-modules
CVE-2026-85013 7.3 - High - September 15, 2026

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's `MODULEPATH`. When the victim uses Bash completion for `module` or `ml` commands, the malicious module name, containing shell metacharacters, is evaluated as a command. This can lead to arbitrary command execution in the completing user's shell, impacting their confidentiality, integrity, and availability.

Shell injection

libtiff tiff2pdf Heap-BUF Overflow via Truncated StripByteCounts
CVE-2026-18495 6.1 - Medium - September 11, 2026

A flaw was found in libtiff. A heap-buffer overflow vulnerability exists in the `tiff2pdf` utility due to an integer truncation error when processing crafted BigTIFF files. An attacker can provide a specially crafted BigTIFF file, causing a 64-bit `StripByteCounts` value to be truncated to a 32-bit integer. This leads to an undersized memory allocation and a subsequent out-of-bounds memory copy, resulting in a crash and severe memory corruption.

Heap-based Buffer Overflow

CVE-2026-88265: crun 1.29.1 and below pivot_root stdio symlink issue
CVE-2026-88265 5.6 - Medium - September 10, 2026

A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

insecure temporary file

crun 1.29.1: /dev Console Redirect via Terminal Setup Insecure Bind-Mount
CVE-2026-88264 5.6 - Medium - September 10, 2026

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed release is available yet.

insecure temporary file

crun 1.29+ Priv Esc via PassNet (libkrun)
CVE-2026-84042 7.8 - High - September 10, 2026

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

Improper Privilege Management

CUPS Username ACL Bypass via Case-Insensitive Comparisons
CVE-2026-87876 3 - Low - September 09, 2026

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of username-based access controls in certain configurations.

Improper Handling of Case Sensitivity

CUPS UTF32ToUTF8 Heap OOB Read via SNMP
CVE-2026-87875 4.3 - Medium - September 09, 2026

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

Out-of-bounds Read

Bubblewrap <0.12.0: Symlink Escape via /oldroot During Sandbox Setup
CVE-2026-87766 8.8 - High - September 09, 2026

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

insecure temporary file

libxml2 Python SAX Binding Double-Free DoS CVE-2026-74860
CVE-2026-74860 8.5 - High - September 08, 2026

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callback handler, where a string is freed twice. This flaw can lead to a denial of service (DoS) due to a reproducible crash in Python applications using the libxml2 SAX bindings.

Release of Invalid Pointer or Reference

Race Condition in GLib2 g_file_replace() Enables File Redirect
CVE-2026-86469 5.3 - Medium - September 07, 2026

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.

insecure temporary file

RedHat RPM rpmuncompress Command Injection via Unescaped Filename
CVE-2026-84838 7.8 - High - September 02, 2026

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.

Shell injection

Command Injection in rpmbuild via Path Manipulation
CVE-2026-84837 7.8 - High - September 02, 2026

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous integration (CI) workflows that ingest externally supplied artifact names. Successful exploitation allows for arbitrary command execution with the privileges of the build user, which could lead to information disclosure or disruption of the build environment.

Shell injection

Linux Kernel 6.15+ X-mount.subdir Symlink Traversal Local PrivEsc
CVE-2026-78409 7 - High - September 02, 2026

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

insecure temporary file

util-linux Local Privilege Escalation via Redirected Restricted Bind Mount
CVE-2026-78410 7.8 - High - September 02, 2026

A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

TOCTTOU

CVE-2026-78408: nsenter --join-cgroup root-FD leak allows cgroup migration
CVE-2026-78408 7.9 - High - September 02, 2026

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

Missing Release of File Descriptor or Handle after Effective Lifetime

Local Command Execution via Macro Expansion in rpm's rpmuncompress
CVE-2026-84233 7 - High - September 01, 2026

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability.

Shell injection

popt ConfigFileToString Realloc Heap Corruption (CVE-2026-18743)
CVE-2026-18743 2.5 - Low - September 01, 2026

A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the `poptConfigFileToString` function reallocates memory for buffers. Successful exploitation could result in heap metadata corruption, potentially causing the affected process to become unavailable (denial of service).

Incorrect Calculation of Buffer Size

GDB STABS Debug Format Parser Buffer Overflow in read_member_functions
CVE-2026-13732 7 - High - August 31, 2026

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the function list is copied to its final allocated array. An attacker can craft an ELF binary with malicious .stab and .stabstr sections that triggers this out-of-bounds write when a user opens the file in GDB and performs any symbol-inspection operation such as setting a breakpoint. The inferior process does not need to be executed. Under controlled conditions, this was demonstrated to achieve execution of arbitrary commands within the GDB process.

Memory Corruption

OOB Write in libsolv .solv Cache Rewrite Causing DoS
CVE-2026-82327 5.5 - Medium - August 28, 2026

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that they fall within the expected range. A corrupted or specially crafted .solv cache file (for example, one left in a torn state after an unclean system shutdown) can cause an out-of-bounds memory write when a tool such as dnf, yum, or zypper next processes it. Successful exploitation is expected to result in a crash of the affected tool (denial of service); it is not expected to allow arbitrary code execution because the out-of-bounds write always stores a fixed, non-attacker-controlled value.

out-of-bounds array index

NetworkManager Vulnerable 802-1x.ca-path CA Path Bypass (CVE-2026-19685)
CVE-2026-19685 9.8 - Critical - August 24, 2026

NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connection profile's CA path at an attacker-controlled directory, bypassing server certificate validation and enabling credential theft via a rogue access point.

AuthZ

rpmbuild Macro Injection via Tar Member Name
CVE-2026-78367 7 - High - August 24, 2026

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression. A specially crafted .spec member name can therefore inject RPM macros, including Lua expressions, resulting in arbitrary code execution with the privileges of the user running rpmbuild. This can be exploited when a victim or automated build system processes an attacker-controlled source tarball using rpmbuild tarball mode (such as -ts, -ta, or -tb).

Code Injection

Binutils <2.46.1: PE File Stack Bof Arbitrary Code Exec
CVE-2026-19582 - August 20, 2026

Vim netrw Arbitrary Vimscript via Quote Breakout in Mark/Unmark
CVE-2026-43961 7.8 - High - August 19, 2026

A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

Code Injection

Libdm Recursion DoS via LVM Metadata (CVE-2026-19617)
CVE-2026-19617 5.5 - Medium - August 14, 2026

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.

Allocation of Resources Without Limits or Throttling

Podman 5.8.x Quadlet Replace Truncation Flaw Security Data Leakage
CVE-2026-19730 4.2 - Medium - August 13, 2026

The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback).

Insufficient Cleanup

UAF in GNU ld (binutils) add_archive_element
CVE-2026-19548 5.5 - Medium - August 12, 2026

Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct locations in add_archive_element: 1. Line ~1442: accessing abfd->my_archive via bfd_usrdata(abfd->my_archive) 2. Line ~1493: multiple accesses to abfd and abfd->my_archive in a conditional check and bfd_get_filename call 3. Line ~1525: dereferencing the shallow copy orig_input.the_bfd->my_archive in trace/verbose logging The vulnerability is triggered when LTO plugins are active (link_info.lto_plugin_active is true) and the input object has abfd->my_archive == NULL, which is a valid state for standalone object files. Red Hat builds binutils with --enable-plugins and --enable-lto, confirming the vulnerable code path is compiled in and reachable. An attacker who can supply a crafted object or archive file to a build process using LTO-enabled linking could exploit this flaw to cause a denial of service (linker crash via segmentation fault). Arbitrary code execution is theoretically possible through heap manipulation but is substantially mitigated by hardening measures including stack protector, FORTIFY_SOURCE, ASLR, and PIE. The attack surface is limited to build-time environments the linker is a development tool not exposed in production runtime. The most realistic exploitation scenario is a supply chain attack introducing a crafted object file as a build dependency in CI/CD pipelines or development environments.

Dangling pointer

OpenVT PrivEsc via UID TTY Mismatch in Red Hat util-linux
CVE-2026-72693 7.8 - High - August 11, 2026

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root` or the getty owner after logout while an unprivileged process still has `fd 0` attached to that TTY, the check can incorrectly treat that process as belonging to the privileged console owner. Once that check succeeds, the `-u` path executes a passwordless login as the selected user. In the documented `kbrequest`/init deployment using `openvt -us`, this can result in passwordless `login -f root` on the spawned VT. This report establishes that privilege escalation path for that documented deployment; it does not claim equivalent reachability for deployments that do not use `openvt -u` from a privileged `kbrequest`/init path.

Authorization

dracut initramfs cmd injection via unquoted DHCP ROOT_PATH
CVE-2026-15816 7.5 - High - August 07, 2026

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Shell injection