CVE-2026-15816: Dracut DHCP RCE Vulnerability

CVE-2026-15816 Overview

CVE-2026-15816 is a command injection flaw in dracut, the initramfs infrastructure used by Red Hat Enterprise Linux and other distributions. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without shell-quoting the content. When the message includes data derived from the Dynamic Host Configuration Protocol (DHCP) ROOT_PATH option, an attacker on the adjacent network operating a rogue DHCP server can inject a command-substitution sequence. The injected payload executes as root the next time dracut sources its emergency hook scripts during boot-failure handling. The weakness is tracked as [CWE-78] (OS Command Injection).

Critical Impact
An adjacent-network attacker running a rogue DHCP server can achieve root code execution in the initramfs during boot-failure recovery.

Affected Products

Red Hat Enterprise Linux distributions shipping vulnerable dracut builds (see RHSA-2026:54571, RHSA-2026:54575, RHSA-2026:54576)
Systems using dracut network-boot modules (40network/netroot.sh) that parse DHCP ROOT_PATH
Any Linux distribution consuming affected upstream dracut releases

Discovery Timeline

2026-08-07 - CVE-2026-15816 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-15816

Vulnerability Analysis

The flaw resides in the die() helper defined in dracut-lib.sh under modules.d/99base/. When a boot-time failure occurs, die() records a diagnostic message by appending it directly into a shell script located inside the initramfs emergency-hook directory. The emergency-hook scripts are later sourced by the running shell during standard boot-failure handling, meaning any unquoted shell metacharacters in the recorded message are interpreted as code.

The network boot path in modules.d/40network/netroot.sh obtains the root filesystem location from the DHCP ROOT_PATH option supplied by the DHCP server. If parsing or mounting fails, the value flows into die() as part of the error message. Because the writer does not apply shell quoting, attacker-controlled bytes are embedded verbatim into a script that later executes as root.

Root Cause

The root cause is missing output sanitization when constructing shell scripts from untrusted input. The die() function treats network-supplied strings as safe text, but the destination artifact is a shell script that will be sourced. This mismatch between the data producer and the consumer allows metacharacters such as $(...) and backticks to be re-interpreted as commands.

Attack Vector

An attacker on the same broadcast domain runs a rogue DHCP server and responds to a target host performing network boot or DHCP-driven root discovery. The rogue server returns a crafted ROOT_PATH value containing a command-substitution sequence. When the target host fails to mount the network root, dracut invokes die(), writes the poisoned message into an emergency-hook script, and executes the embedded commands as root during recovery.

The attack requires adjacent-network access, no authentication, and no user interaction, but depends on the target triggering the emergency-hook flow during boot. Public exploit code is not available at the time of writing. Technical details are documented in the Red Hat CVE analysis and the upstream dracut netroot script.

Detection Methods for CVE-2026-15816

Indicators of Compromise

Unexpected shell scripts in the initramfs emergency-hook directory containing command-substitution sequences ($(...), backticks) derived from DHCP option 17.
DHCP OFFER or ACK packets on the local segment carrying ROOT_PATH values with shell metacharacters.
Unexplained root-owned processes spawned during early boot on network-booted hosts.

Detection Strategies

Inspect DHCP traffic on management and provisioning VLANs for rogue servers issuing anomalous ROOT_PATH values.
Audit initramfs images (lsinitrd) on affected hosts for tampered emergency-hook scripts.
Correlate boot-failure events with subsequent process creation anomalies using endpoint telemetry.

Monitoring Recommendations

Enable DHCP snooping and rogue-DHCP detection on network switches to block unauthorized DHCP servers.
Forward kernel and early-userspace logs (journalctl -b) to a central log store and alert on dracutdie() invocations.
Monitor for new or unauthorized DHCP servers appearing on ARP tables and DHCP relay logs.

How to Mitigate CVE-2026-15816

Immediate Actions Required

Apply the vendor-supplied dracut updates referenced in RHSA-2026:54571, RHSA-2026:54575, and RHSA-2026:54576.
Rebuild initramfs images with dracut -f after installing the update so patched scripts are embedded.
Enable DHCP snooping on access switches to prevent rogue DHCP servers from reaching client segments.

Patch Information

Red Hat has published fixes through advisories RHSA-2026:54571, RHSA-2026:54575, and RHSA-2026:54576. Additional context is available in Red Hat Bugzilla entries #2459963 and #2500889. Administrators should upgrade dracut to the fixed package version distributed by their vendor and regenerate all initramfs images on affected hosts.

Workarounds

Disable network-root boot paths on systems that do not require them by removing the 40network and related nfs/iscsi modules from dracut.conf.
Restrict DHCP to trusted servers using switch-level DHCP snooping and 802.1X authentication on client ports.
Use static IP configuration for hosts that must network-boot until patches are applied.

bash

# Rebuild initramfs after installing the patched dracut package
sudo dnf update dracut
sudo dracut -f --regenerate-all

# Optional: remove network modules if network boot is not required
echo 'omit_dracutmodules+=" network nfs iscsi "' | \
    sudo tee /etc/dracut.conf.d/99-no-network.conf
sudo dracut -f