CVE-2026-15816

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.(CVE-2026-15816)

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.(CVE-2026-15816)

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.(CVE-2026-15816)

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.(CVE-2026-15816)

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.

Security Fix(es):

• dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2026-15816: escape DHCP-controlled data reaching die() and export_n

• CVE-2026-15816: escape DHCP-controlled data reaching die() and export_n

These are all security issues fixed in the dracut-112+suse.29.gc0c5e1d-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dracut fixes the following issue:

Update to version 059+suse.726.gde083b3a1.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.645.g79fd74d.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.611.g7d90691.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.726.gde083b3a1.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.726.gde083b3a1.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

This update for dracut fixes the following issue:

Update to version 055+suse.367.g85633e8.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 055+suse.404.gc96044c.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.567.gf5cfeb7f7.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

This update for dracut fixes the following issue:

Update to version 059+suse.572.g753fdae1b.

Securitys issue fixed:

• CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die() (bsc#1274432).

Other updates and bugfixes:

• Fix(base): sanitize message written by die() to the emergency hook.
• Feat(base): add escape function implementing printf %q.

It was discovered that dracut did not properly shell-quote messages written by the die() function to the emergency hook directory. An attacker on the adjacent network controlling a rogue DHCP server could use this issue to inject commands that execute as root during boot-failure handling. (CVE-2026-15816)

It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637)

It was discovered that dracut did not properly sanitize DHCP options before writing them to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)

It was discovered that dracut did not properly quote error messages written to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-15816)

It was discovered that dracut did not properly sanitize network configuration data before writing it to a temporary shell script under certain circumstances. A remote attacker controlling DHCP on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 22.04 LTS. (CVE-2026-16445)