CVE-2026-15816— Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
dracutdevs dracut是dracutdevs组织开源的一个事件驱动的 initramfs 基础设施。 dracutdevs dracut存在命令注入漏洞，该漏洞源于die()错误处理函数在initramfs紧急挂钩目录下写入shell脚本时未正确进行shell引用，当消息包含来自DHCP ROOT_PATH选项的数据时，可能允许相邻网络的攻击者控制恶意DHCP服务器注入命令替换序列，导致以root权限执行命令。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 28
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-15816
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
dracutdevs dracut 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dracutdevs dracut是dracutdevs组织开源的一个事件驱动的 initramfs 基础设施。 dracutdevs dracut存在命令注入漏洞，该漏洞源于die()错误处理函数在initramfs紧急挂钩目录下写入shell脚本时未正确进行shell引用，当消息包含来自DHCP ROOT_PATH选项的数据时，可能允许相邻网络的攻击者控制恶意DHCP服务器注入命令替换序列，导致以root权限执行命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 0:107-9.el10_2 ~ * |
cpe:/o:redhat:enterprise_linux:10.2
|
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 0:105-4.el10_0.1 ~ * |
cpe:/o:redhat:enterprise_linux_eus:10.0
|
|
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | 0:004-413.el6_10 ~ * |
cpe:/o:redhat:rhel_els:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:033-577.el7_9 ~ * |
cpe:/o:redhat:rhel_els:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | 0:049-246.git20260728.el8_10 ~ * |
cpe:/o:redhat:enterprise_linux:8::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | 0:049-138.git20220131.el8_4.1 ~ * |
cpe:/o:redhat:rhel_aus:8.4::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | 0:049-138.git20220131.el8_4.1 ~ * |
cpe:/o:redhat:rhel_aus:8.4::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | 0:049-203.git20220511.el8_6.1 ~ * |
cpe:/o:redhat:rhel_aus:8.6::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | 0:049-203.git20220511.el8_6.1 ~ * |
cpe:/o:redhat:rhel_aus:8.6::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 0:049-223.git20230119.el8_8.1 ~ * |
cpe:/o:redhat:rhel_e4s:8.8::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 0:049-223.git20230119.el8_8.1 ~ * |
cpe:/o:redhat:rhel_e4s:8.8::baseos
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:057-120.git20260728.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9 | 0:057-120.git20260728.el9_8 ~ * |
cpe:/a:redhat:enterprise_linux:9::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 0:057-25.git20250717.el9_2.2 ~ * |
cpe:/a:redhat:rhel_e4s:9.2::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 0:057-54.git20250423.el9_4.3 ~ * |
cpe:/a:redhat:rhel_e4s:9.4::appstream
|
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 0:057-89.git20250311.el9_6.1 ~ * |
cpe:/a:redhat:rhel_eus:9.6::appstream
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.13 | 413.92.202609080414-0 ~ * |
cpe:/a:redhat:openshift:4.13::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.14 | 414.92.202609011250-0 ~ * |
cpe:/a:redhat:openshift:4.14::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.15 | 415.92.202609140326-0 ~ * |
cpe:/a:redhat:openshift:4.15::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.16 | 416.94.202609011112-0 ~ * |
cpe:/a:redhat:openshift:4.16::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.17 | 417.94.202609191027-0 ~ * |
cpe:/a:redhat:openshift:4.17::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 418.94.202609031320-0 ~ * |
cpe:/a:redhat:openshift:4.18::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.18 | 418.94.202609171815-0 ~ * |
cpe:/a:redhat:openshift:4.18::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.19 | 4.19.9.6.202609021231-0 ~ * |
cpe:/a:redhat:openshift:4.19::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.20 | 4.20.9.6.202608260604-0 ~ * |
cpe:/a:redhat:openshift:4.20::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.21 | 4.21.9.6.202609021100-0 ~ * |
cpe:/a:redhat:openshift:4.21::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 4.22.9.8.202608251819-0 ~ * |
cpe:/a:redhat:openshift:4.22::el9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4.22 | 4.22.9.8.202609081748-0 ~ * |
cpe:/a:redhat:openshift:4.22::el9
|
|
| Red Hat | Red Hat Hardened Images | - |
cpe:/a:redhat:hummingbird:1
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-15816
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Reproduced successfully in a real sandbox
· Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker:
VULNERABLE: dracut die() RCE confirmed - injected $(...) executed as uid=0, exfiltrated flag=PROOF_bd553b3beb08126a via sourced emergency hook
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code
· 9262 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-15816
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15816 (1)
Vendor Advisories for CVE-2026-15816 (25)
-
🔗 https://access.redhat.com/security/cve/CVE-2026-15816 Read full article vdb-entry x_refsource_REDHAT
-
-
-
-
-
-
-
-
🔗 RHSA-2026:54575 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
-
-
-
-
🔗 RHSA-2026:70586 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:61252 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
🔗 RHSA-2026:60440 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
-
-
-
Other References for CVE-2026-15816 (2)
Same Patch Batch · Red Hat · 2026-08-07 · 4 CVEs total
| CVE-2026-18938 | 6.2 MEDIUM | P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nes |
| CVE-2026-19079 | 4.4 MEDIUM | Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selin |
| CVE-2026-61477 | 2.3 LOW | Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq confi |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie
Same vendor: Red Hat
-
CVE-2026-86345
389-ds-base: 389-ds-base: starttls plaintext-buffer retentio -
CVE-2026-86344
389-ds-base: 389-ds-base: unauthenticated worker-thread-pool -
CVE-2026-103884
Keycloak-services: keycloak-services: path traversal in x.50 -
CVE-2026-56098
Rubygem-katello: improper authorization logic allows resourc -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
Same weakness: CWE-78
-
CVE-2026-71452
Johnson Controls EasyIO FS32 3.0b63以下命令注入漏洞 -
CVE-2026-71451
Johnson Controls EasyIO FS32 < 3.0b63 命令注入漏洞 -
CVE-2026-84682
TDDPv2 setProductVer Command Injection in Archer AX90 -
CVE-2026-102294
Authenticated OS Command Injection in TL-WR841N IPv6 WAN Con -
CVE-2026-12545
Rubygem-hammer_cli: command injection via insecure editor in
V. Comments for CVE-2026-15816
No comments yet