CVE-2026-15816
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Risk Assessment
The risk includes the possibility of remote code execution as root by an attacker on the adjacent network, potentially leading to full system compromise.
Recommendation
It is recommended to update dracut to a patched version immediately and to limit trust in DHCP servers on the network.
Other vulnerabilities in dracut
See all- CVE-2026-16445High
A command injection vulnerability in dracut. A remote attacker on the adjacent network can provide crafted DHCP options, leading to code execution in initramfs during system boot.
- CVE-2026-6893High
A flaw in dracut allows a remote attacker on the adjacent network to inject commands via specially crafted DHCP options (e.g., a malicious hostname). These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. The attacker can achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Original NVD description (English source)
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.