The vulnerability (CVE-2026-15816) exists in dracut's die() function, which writes error messages into shell scripts under the initramfs emergency-hook directory without proper shell quoting. If the error message includes data derived from the DHCP ROOT_PATH option, an attacker on the same network segment who controls a rogue DHCP server can inject command-substitution sequences. These sequences execute with root privileges the next time dracut sources its emergency hook scripts during boot-failure handling. Exploitation requires network booting with DHCP and failure of the netroot handler resolution, conditions controlled by an adjacent attacker. This vulnerability is distinct from CVE-2026-6893 and affects only systems relying on DHCP-supplied ROOT_PATH values during network boot.

Successful exploitation allows an attacker on the adjacent network to execute arbitrary commands as root during system boot failure handling, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability by enabling unauthorized code execution, data modification, and denial of service. Systems not performing network boot or not using DHCP-supplied ROOT_PATH values are not affected.

Currently, no official patch is confirmed available. Until a fix is released, restrict access to DHCP servers on networks used for network boot by implementing DHCP snooping or using dedicated/trusted provisioning VLANs. Systems not performing network boot or not relying on DHCP-supplied ROOT_PATH values are not exposed. Monitor vendor advisories for updates and apply official fixes once available.