dracut initramfs cmd injection via unquoted DHCP ROOT_PATH
CVE-2026-15816 Published on August 7, 2026
Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 56 days later.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-15816 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-15816
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
