Dracut Emergency Hook Command Injection via DHCP

A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-15816 is a critical command injection vulnerability in dracut, the initramfs generator used by Linux systems for early boot processes. The flaw exists in the die() error-handling function, which fails to properly shell-quote messages before writing them into shell scripts within the initramfs emergency-hook directory. An attacker controlling a rogue DHCP server on an adjacent network can exploit this by injecting malicious command-substitution sequences into the DHCP ROOT_PATH option. When dracut sources these emergency hook scripts during boot failure handling, the injected commands execute with root privileges, giving attackers complete system compromise. This affects any Linux system using dracut that may encounter untrusted DHCP responses—including cloud instances, enterprise servers, and IoT devices that perform network boot or recovery operations.

Casky's 446 matching skills, powered by Claude's extended reasoning capabilities, map this vulnerability across three critical MITRE ATT&CK tactics: Initial Access (TA0001) for the DHCP-based attack vector, Execution (TA0002) for command injection, and Persistence (TA0043) for root-level code execution during boot. Practitioners using Casky would identify detection patterns including: suspicious DHCP traffic with oversized or specially-crafted ROOT_PATH options, unexpected shell metacharacters in initramfs emergency hook files, and command execution originating from dracut processes with root context during boot sequences. The platform's skill correlation would highlight the progression from network reconnaissance of DHCP servers, through exploitation of the unquoted variable injection, to post-exploitation activities—enabling defenders to construct detection rules across network monitoring, file integrity checking, and process execution logging to catch this attack chain at multiple stages.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15816.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-15816

Casky has 446 skills that investigate the attack patterns behind CVE-2026-15816. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn