CVE-2026-15816

CVE-2026-15816 describes a vulnerability in dracut where the die() error-handling function writes its message into an initramfs emergency-hook script without proper shell-quoting. If the message contains data from the DHCP ROOT_PATH option, an adjacent attacker controlling a rogue DHCP server can...