--- cve: "CVE-2026-15816" severity: "HIGH" cvss: 7.5 epss: "0.3%" vendor: "Red Hat" kev: false exploited: false published: "2026-08-07 11:17:05" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-21T14:47:37+02:00" --- # CVE-2026-15816 > 7.5 HIGH · đŸ§Ș PoC ## Beschreibung A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling. ## CVSS-Vektor ``` CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Benachbart | warn | | AC KomplexitĂ€t | Hoch | good | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | UnverĂ€ndert | good | | C Vertraulichkeit | Hoch | bad | | I IntegritĂ€t | Hoch | bad | | A VerfĂŒgbarkeit | Hoch | bad | ## Referenzen - - - - - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-15816) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_