The flaw in dracut arises because the die() function writes error messages into a shell script under the initramfs emergency-hook directory without proper shell quoting. If the error message includes data derived from the DHCP ROOT_PATH option, an attacker controlling a rogue DHCP server on the same network segment can inject a command-substitution sequence. This malicious code executes as root the next time dracut sources its emergency hook scripts during boot-failure handling. Exploitation requires network boot with DHCP-supplied ROOT_PATH and failure of the netroot handler resolution, triggering the emergency shell mechanism. Systems not using network boot or DHCP ROOT_PATH are not affected.

Successful exploitation results in root-level code execution on affected systems during boot failure handling. This can compromise confidentiality, integrity, and availability of the system. The attack requires an adjacent network attacker controlling or spoofing a DHCP server and conditions that cause dracut to invoke its emergency shell. Systems not performing network boot or not relying on DHCP ROOT_PATH are not impacted.

Restrict access to DHCP servers on networks used for network boot by implementing DHCP snooping or using dedicated/trusted provisioning VLANs until an official fix is available. Monitor vendor advisories for patches and apply them once released. Systems not using network boot or DHCP ROOT_PATH are not vulnerable and require no action.