Public vulnerability disclosure
CVE-2026-15816
Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
publishedCWE-78
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Technical severity7.5 highCVSS 3.1 · CNA: redhat
Published2026-08-07Source updated 2026-11-02
Collected2026-11-022 attributed sources
Fixes and workarounds
Workaround
Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 10 Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:107-9.el10_2; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:105-4.el10_0.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:004-413.el6_10; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:004-414.el6_10; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:033-577.el7_9; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8 Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-246.git20260728.el8_10; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-138.git20220131.el8_4.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-138.git20220131.el8_4.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-203.git20220511.el8_6.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-203.git20220511.el8_6.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-223.git20230119.el8_8.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:049-223.git20230119.el8_8.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9 Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:057-120.git20260728.el9_8; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:057-25.git20250717.el9_2.2; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:057-54.git20250423.el9_4.3; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Enterprise Linux 9.6 Extended Update Support Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
≥ 0:057-89.git20250311.el9_6.1; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.12 Red Hat openshift/ose-rhel-coreos-8
https://access.redhat.com/downloads/content/package-browser/ |
≥ 412.86.202610250235-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.13 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 413.92.202609080414-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.14 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 414.92.202609011250-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.15 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 415.92.202609140326-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.16 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 416.94.202609011112-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.17 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 417.94.202609191027-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.18 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 418.94.202609031320-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.18 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 418.94.202609171815-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.19 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 4.19.9.6.202609021231-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.20 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 4.20.9.6.202608260604-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.21 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 4.21.9.6.202609021100-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.22 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 4.22.9.8.202608251819-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat OpenShift Container Platform 4.22 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
≥ 4.22.9.8.202609081748-0; < * (unaffected, rpm)
Other versions: affected |
CNA: redhat |
| Red Hat Hardened Images Red Hat dracut
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat OpenShift Container Platform 5 Red Hat openshift/ose-rhel-coreos-9
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 7.5 high |
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA: redhat |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/errata/RHSA-2026:54571CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54575CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54576CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57580CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57772CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57775CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:57785CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60440CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60445CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:61252CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62269CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62409CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:62549CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63041CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:63044CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65839CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65851CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66357CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:67857CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:69118CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:69119CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:70586CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:70615CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:74499CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:79114CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:90272CNA: redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-15816CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2459963CNA: redhat
- https://bugzilla.redhat.com/show_bug.cgi?id=2500889CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.shCNA: redhat
- https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.shCNA: redhat