Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

[Nixpkgs security tracker issue](https://tracker.security.nixos.org//issues/NIXPKGS-2026-2381) ## [CVE-2026-15816](https://nvd.nist.gov/vuln/detail/CVE-2026-15816) <details> <summary><strong>7.5 HIGH</strong> | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</summary> - CVSS version (CVSS): 3.1 - Attack Vector (AV): Adjacent (A) - Attack Complexity (AC): High (H) - Privileges Required (PR): None (N) - User Interaction (UI): None (N) - Scope (S): Unchanged (U) - Confidentiality (C): High (H) - Integrity (I): High (H) - Availability (A): High (H) - Modified Attack Vector (MAV): Adjacent (A) - Modified Attack Complexity (MAC): High (H) - Modified Privileges Required (MPR): None (N) - Modified User Interaction (MUI): None (N) - Modified Confidentiality (MC): High (H) - Modified Scope (MS): Unchanged (U) - Modified Integrity (MI): High (H) - Modified Availability (MA): High (H) </details> <details><summary><strong>Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()</strong></summary> A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling. </details> ### References - https://access.redhat.com/security/cve/CVE-2026-15816 (`x_refsource_REDHAT`, `vdb-entry`) - [RHBZ#2500889](https://bugzilla.redhat.com/show_bug.cgi?id=2500889) (`x_refsource_REDHAT`, `issue-tracking`) - https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh - https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh ### Affected packages - `dracut` ([pull requests](https://github.com/NixOS/nixpkgs/pulls?q=sort%3Aupdated-desc+is%3Apr+dracut+in%3Atitle+-%3E+in%3Atitle)) - 059@nixos-26.05 - 111@nixos-unstable Affected package maintainers: cc @tbutter ### Additional comment ``` Not yet fixed upstream (2026-08-10) ``` # Next steps - Start here if this is your first security issue: [Triaging and fixing security issues](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#triaging-and-fixing) - Backports are usually needed: [Backporting security fixes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests)