CVE-2026-15816 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
A remote attacker on the adjacent network can execute arbitrary commands as root via DHCP option injection in dracut emergency hooks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-15816?
CVE-2026-15816 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 7 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Weakness: CWE-78
Which versions are affected by CVE-2026-15816?
Linux distribution packages (40)
dracut AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-caps AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-config-generic AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-config-rescue AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-live AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-network AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-squash AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut-tools AlmaLinux:10 | All versions | 107-9.el10_2 |
dracut AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-caps AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-config-generic AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-config-rescue AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-live AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-network AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-squash AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut-tools AlmaLinux:8 | All versions | 049-246.git20260728.el8_10 |
dracut AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-caps AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-config-generic AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-config-rescue AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-live AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-network AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-squash AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut-tools AlmaLinux:9 | All versions | 057-120.git20260728.el9_8 |
dracut Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-caps Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-config-generic Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-config-rescue Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-live Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-network Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-squash Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut-tools Red Hat:enterprise_linux:10.2 | All versions | 0:107-9.el10_2 |
dracut Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
dracut-caps Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
dracut-config-generic Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
dracut-config-rescue Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
dracut-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
dracut-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:049-246.git20260728.el8_10 |
How do I fix CVE-2026-15816?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-15816 being exploited?
There is no known exploitation of CVE-2026-15816 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:54571, ALSA-2026:54575, ALSA-2026:54576, CLSA-2026-1787152228, CLSA-2026-1787153216, DEBIAN-CVE-2026-15816 and 25 more.