Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-05T23:59:00 dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Red Hat Product Security rates this flaw's impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut's netroot handler resolution -- both fully within an adjacent-network attacker's control. Reaching the point where the poisoned hook script is actually sourced depends on dracut's boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh's die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue. This issue was discovered by Pavel Valena (Red Hat). Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available. Red Hat Enterprise Linux 10 Affected dracut Red Hat Enterprise Linux 6 Out of support scope dracut Red Hat Enterprise Linux 7 Affected dracut Red Hat Enterprise Linux 8 Affected dracut Red Hat Enterprise Linux 9 Affected dracut Red Hat Hardened Images Not affected dracut Red Hat OpenShift Container Platform 4 Affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-15816 https://nvd.nist.gov/vuln/detail/CVE-2026-15816 https://bugzilla.redhat.com/show_bug.cgi?id=2459963 https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh