A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
red hat:red hat enterprise linux 6
red hat:red hat enterprise linux 10
red hat:red hat enterprise linux 8
red hat:red hat hardened images
red hat:red hat openshift container platform 4
red hat:red hat enterprise linux 7
red hat:red hat enterprise linux 9
References 8
https://access.redhat.com/security/cve/CVE-2026-15816
NVD
https://bugzilla.redhat.com/show_bug.cgi?id=2459963
NVD
https://bugzilla.redhat.com/show_bug.cgi?id=2500889
RHBZ#2500889
https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh
NVD
https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh
NVD
https://access.redhat.com/errata/RHSA-2026:54571
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:54575
secalert@redhat.com
https://access.redhat.com/errata/RHSA-2026:54576
secalert@redhat.com