Bug#1147447: dracut: CVE-2026-15816

From	Moritz Mühlenhoff <jmm@inutil.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1147447: dracut: CVE-2026-15816
Date	2026-09-11 22:50 +0200
Message-ID	<NCgm5-gBGH-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Source: dracut
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for dracut.

CVE-2026-15816[0]:
| A flaw was found in dracut. The die() error-handling function writes
| its message into a shell script under the initramfs emergency-hook
| directory without properly shell-quoting it. When the message
| contains data derived from the DHCP ROOT_PATH option, an attacker on
| the adjacent network who controls a rogue DHCP server can inject a
| command-substitution sequence that executes as root the next time
| dracut sources its emergency hook scripts during standard boot-
| failure handling.

https://bugzilla.redhat.com/show_bug.cgi?id=2500889


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-15816
    https://www.cve.org/CVERecord?id=CVE-2026-15816

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.kernel | Previous | Next | Find similar | Unroll thread

Thread

Bug#1147447: dracut: CVE-2026-15816 Moritz Mühlenhoff <jmm@inutil.org> - 2026-09-11 22:50 +0200

csiph-web