What’s Vulnerable › Vulnerabilities

CVE-2026-15816: Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Description

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Affected products

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 418.94.202609031320-0; Red Hat Enterprise Linux 10 0:107-9.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:105-4.el10_0.1; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:004-413.el6_10; Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:033-577.el7_9; Red Hat Enterprise Linux 8 0:049-246.git20260728.el8_10; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:049-203.git20220511.el8_6.1; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:049-203.git20220511.el8_6.1; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-15816 or the next vulnerability affects your stack