7.5

CVE-2026-15816: dracut OS Command Injection

CVSS: 7.5v3.1HighAwaiting analysis
AliasesSUSE-SU-2026:23195-1SUSE-SU-2026:23246-1SUSE-SU-2026:23276-1
Published 07-08-2026Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2026-15816 is a high (CVSS 7.5) OS Command Injection vulnerability in dracut. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.37%
0%100%
Low · +0.07 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 1
RHSA-2026:57580RHSA-2026:57772RHSA-2026:57775RHSA-2026:57785RHSA-2026:61252RHSA-2026:62269

Timeline

  1. 07-08-2026
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

+0.07 pp

From 0.30% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse23 products
  • dracut&distro=SUSE Linux Enterprise High Availability Extension 15 SP6< 059+suse.567.gf5cfeb7f7-150600.3.32.1
  • dracut&distro=SUSE Linux Enterprise High Availability Extension 15 SP7< 059+suse.572.g753fdae1b-150700.3.20.1
  • dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 055+suse.367.g85633e8-150400.3.52.1
  • dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 055+suse.367.g85633e8-150400.3.52.1
  • dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 055+suse.404.gc96044c-150500.3.44.1
Redhat10 products
  • dracut< 0:057-120.git20260728.el9_8 | < 0:049-246.git20260728.el8_10 | < 0:107-9.el10_2
  • dracut-caps< 0:057-120.git20260728.el9_8 | < 0:049-246.git20260728.el8_10 | < 0:107-9.el10_2
  • dracut-config-generic< 0:057-120.git20260728.el9_8 | < 0:049-246.git20260728.el8_10 | < 0:107-9.el10_2
  • dracut-config-rescue< 0:057-120.git20260728.el9_8 | < 0:049-246.git20260728.el8_10 | < 0:107-9.el10_2
  • dracut-debuginfo< 0:057-120.git20260728.el9_8 | < 0:049-246.git20260728.el8_10 | < 0:107-9.el10_2
Opensuse2 products
  • dracut&distro=openSUSE Leap 16.0< 059+suse.726.gde083b3a1-160000.1.1
  • dracut&distro=openSUSE Tumbleweed< 112+suse.29.gc0c5e1d-1.1
Debian1 product
  • dracutAll versions (No fix recorded) | < 112-2
Ubuntu1 product
  • dracut< 044+3-3ubuntu0.1~esm1 | < 047-2ubuntu0.1~esm1 | < 048+80-2ubuntu0.1~esm1 | < 051-1ubuntu0.1~esm1 | < 060+5-1ubuntu3.4 | < 110-11ubuntu0.1

5 vendors · 37 products

References

52 links
Show all 52 references