VDB
RHSA-2026:61252
RHSA-2026:61252
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | dracut-config-rescue-0:049-223.git20230119.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-debugsource-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-squash-0:049-223.git20230119.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-debugsource-0:049-223.git20230119.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-squash-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-network-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-tools-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-tools-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-config-rescue-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-caps-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-0:049-223.git20230119.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-debuginfo-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-live-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-debuginfo-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-config-generic-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-network-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-live-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS TUS (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-network-0:049-223.git20230119.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
| Red Hat | dracut-config-rescue-0:049-223.git20230119.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.8) | 0:049-223.git20230119.el8_8.1 |
…and 12 more
Timeline
- Aug 31, 2026 CVE Published
- Sep 1, 2026 CVE Updated
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Distribution Patch
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
- Sep 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:61252 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2459963 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2500889 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2503147 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61252.json advisory
- https://access.redhat.com/security/cve/CVE-2026-6893 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-6893 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-6893 advisory
- https://access.redhat.com/security/cve/CVE-2026-15816 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-15816 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-15816 advisory
- https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh advisory
- https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh advisory
- https://access.redhat.com/security/cve/CVE-2026-16445 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-16445 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16445 advisory
- https://access.redhat.com/errata/RHSA-2026:26534 advisory
- https://github.com/dracutdevs/dracut/commit/e509c638e6 advisory