CVE-2026-15816

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Red Hat Product Security rates this flaw's impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut's netroot handler resolution -- both fully within an adjacent-network attacker's control. Reaching the point where the poisoned hook script is actually sourced depends on dracut's boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh's die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.