Summary
It was discovered that dracut did not properly shell-quote messages
written by the die() function to the emergency hook directory. An
attacker on the adjacent network controlling a rogue DHCP server could
use this issue to inject commands that execute as root during
boot-failure handling. (CVE-2026-15816)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | dracut | 110-11ubuntu0.1 |
Vulnerabilities 1
-
High 7.5
Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an atta…