CVE-2026-15816: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-15816 is an OS command injection vulnerability in dracut, the Linux initramfs generation tool. The die() error-handling function in dracut-lib.sh appends its message to the initramfs emergency hook script ($hookdir/emergency/01-die.sh) using unquoted echo, allowing shell metacharacters to survive into the generated script. When the message contains attacker-controlled data from the DHCP ROOT_PATH option (via netroot.sh's handler-resolution failure path), an adjacent-network attacker operating a rogue DHCP server can inject command-substitution sequences that execute as root during boot-failure handling. The vulnerability was reported on 2026-07-15, publicly disclosed on 2026-08-05, and patched on 2026-08-13. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In dracut-lib.sh, the die() function writes its argument to the emergency hook script using echo "warn dracut: FATAL: \"$*\"" without shell-quoting, meaning any shell metacharacters in the message are preserved verbatim in the generated .sh file. The vulnerable code path is triggered when netroot.sh calls die "No handler for netroot type '$netroot'" after failing to resolve a DHCP-supplied ROOT_PATH value — a value fully controlled by an attacker operating a rogue DHCP server on the same L2 segment. A payload such as $(malicious_command) embedded in the ROOT_PATH option survives into 01-die.sh and executes as root when dracut's emergency_shell() sources all scripts under $hookdir/emergency/ during boot-failure handling. This is a distinct code path from the related CVE-2026-6893, which fixed dhclient-script.sh but did not address die() in dracut-lib.sh (Red Hat CVE, Red Hat Bugzilla, dracut-lib.sh source).

Successful exploitation grants an attacker arbitrary command execution as root within the initramfs environment during boot, enabling full system compromise before the main OS is even loaded. An attacker can read, modify, or destroy data on the target system, install persistent backdoors, or render the system unbootable, affecting confidentiality, integrity, and availability at the highest level. The attack is limited to systems configured for network/PXE boot using DHCP-supplied ROOT_PATH values (root=dhcp or netroot=dhcp); systems that do not perform network boot are not exposed (Red Hat CVE).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.0025 (0.25%), reflecting low near-term exploitation probability. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, given the requirement for an adjacent-network position and a specific boot failure condition. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or spoof a DHCP server on the same network segment as a PXE-booting target, and the injected payload only executes when dracut's boot-failure handling invokes the emergency shell mechanism (Red Hat CVE, Feedly).

1. Reconnaissance: Identify systems on the local network segment that perform PXE/network boot using DHCP (root=dhcp or netroot=dhcp kernel parameters), using network scanning or passive traffic analysis.
2. Set up rogue DHCP server: Deploy a rogue DHCP server (e.g., using dnsmasq or isc-dhcp-server) on the same L2 network segment as the target, configured to respond faster than the legitimate DHCP server.
3. Craft malicious ROOT_PATH: Configure the rogue DHCP server to return a ROOT_PATH option containing a command-substitution payload, for example: ROOT_PATH = "$(touch /tmp/pwned #)" or a more impactful reverse shell payload.
4. Trigger boot failure: The malicious ROOT_PATH value is assigned to $netroot in dracut's netroot.sh. Since the injected value does not match any known netroot handler, netroot.sh calls die "No handler for netroot type '$netroot'", writing the unquoted payload into $hookdir/emergency/01-die.sh.
5. Payload execution: When dracut's initqueue-timeout or emergency handling invokes emergency_shell(), it sources all scripts under $hookdir/emergency/, including the attacker-poisoned 01-die.sh. The embedded command substitution executes as root, completing the compromise (Red Hat Bugzilla, netroot.sh source).

• Network: Unexpected DHCP responses on PXE boot VLANs originating from unauthorized MAC/IP addresses; DHCP ROOT_PATH options containing shell metacharacters such as $(), `, ;, or |.
• File System (initramfs): Contents of $hookdir/emergency/01-die.sh (typically /lib/dracut/hooks/emergency/01-die.sh) containing shell command-substitution sequences or unexpected commands beyond standard warn statements.
• Logs: Boot logs or serial console output showing dracut emergency shell invocation with unusual ROOT_PATH values; kernel ring buffer (dmesg) entries referencing unexpected dracut: FATAL messages containing shell syntax.
• Process/Runtime: Unexpected processes spawned during initramfs boot phase (e.g., curl, wget, nc, bash with network arguments) that are not part of the normal boot sequence; unexpected files created in /tmp or /run during early boot.

Red Hat has released patched dracut packages for all affected RHEL versions: 0:049-246.git20260728.el8_10 (RHEL 8), 0:057-120.git20260728.el9_8 (RHEL 9), and 0:107-9.el10_2 (RHEL 10), delivered via errata RHSA-2026:54575, RHSA-2026:54571, and RHSA-2026:54576 respectively. Additional EUS/SAP errata (RHSA-2026:57580, RHSA-2026:57772, RHSA-2026:57775, RHSA-2026:57785) address extended support versions. SUSE has also released fixes via SUSE-SU-2026:3598-1 and SUSE-SU-2026:3613-1. As a workaround until patching is possible, Red Hat recommends restricting DHCP server access on PXE boot networks using DHCP snooping and dedicated/trusted provisioning VLANs. Systems that do not use network/PXE boot are not affected and require no action (Red Hat CVE, Red Hat Bugzilla, SUSE Advisory).

Red Hat Product Security rated the flaw as "Important" and credited Pavel Valena (Red Hat) with discovery. The vulnerability was noted in the security community as a distinct bypass of the earlier CVE-2026-6893 fix, highlighting that patching one injection vector in dracut did not address the separate die() function code path. BrinzTech published a breach alert characterizing it as a critical command injection vulnerability. The openSUSE and SUSE security mailing lists issued advisories, and the vulnerability received coverage in German Linux security media (pro-linux.de). Social media discussion was limited, with automated CVE notification accounts on Mastodon/Nitter being the primary amplifiers (Red Hat CVE, BrinzTech Alert, SUSE Advisory).