Command Injection Vulnerability in Dracut Affecting Red Hat
CVE-2026-15816

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Vendor: CVE Published:; 7 August 2026

What is CVE-2026-15816?

A vulnerability exists in Dracut that allows an attacker on an adjacent network to exploit a flaw in the way the die() error-handling function writes messages to shell scripts. The lack of proper shell-quoting in the handling of messages from the DHCP ROOT_PATH option may allow the attacker, who controls a rogue DHCP server, to inject command-substitution sequences. This risky behavior can lead to the execution of arbitrary commands with root privileges when the affected system’s emergency hook scripts are sourced during standard boot-failure handling. Addressing this vulnerability is crucial to maintaining system integrity and security.