CVE-2026-15816: Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 10

  • 0:107-9.el10_2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:105-4.el10_0.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION

  • 0:004-413.el6_10 and laternot affected · rpm
  • 0:004-414.el6_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:033-577.el7_9 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:049-246.git20260728.el8_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 0:049-138.git20220131.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • 0:049-138.git20220131.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • 0:049-203.git20220511.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • 0:049-203.git20220511.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • 0:049-223.git20230119.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • 0:049-223.git20230119.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9

  • 0:057-120.git20260728.el9_8 and laternot affected · rpm
  • 0:057-120.git20260728.el9_8 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-10230Samba: command injection in wins server hook script
  52Plan
• CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
  44Plan
• CVE-2026-76578Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-7867Aug 6, 2026 · Udisks2: udisks2: local privilege escalation via as-user option spoofing
  31Monitor
• ← EarlierCVE-2026-18938Aug 7, 2026 · P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems
  24Monitor
• Later →CVE-2026-61477Aug 7, 2026 · Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
  9Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.