A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.

A flaw was found in dracut. The die() function in dracut-lib.sh appends its error message to $hookdir/emergency/01-die.sh using echo "warn dracut: FATAL: \"$\"", without shell-quoting the message. When the message passed to die() contains DHCP-controlled data -- specifically $netroot, derived from the DHCP ROOTPATH option via netroot.sh's handler-resolution failure path (die "No handler for netroot type '$netroot'") -- a command-substitution sequence such as $(cmd) embedded in that data survives into the generated 01-die.sh line and executes as root the next time dracut sources the emergency hook directory. This occurs during dracut's standard boot-failure handling: when the netroot handler cannot be resolved, dracut's initqueue-timeout fallback (or, on non-default rd.shell configurations, die() itself) eventually invokes emergencyshell(), which sources every script under $hookdir/emergency/, including the attacker-poisoned 01-die.sh. This is a distinct code path from CVE-2026-6893 (dhclient-script.sh writing unescaped DHCP hostname/route values); CVE-2026-6893's fix does not touch die() and does not remediate this issue. Reproduced directly against die() extracted from shipped dracut RPMs spanning RHEL 6 through RHEL 10 in an isolated sandbox: a crafted netroot value containing $(touch /tmp/marker) created the marker file upon sourcing the generated 01-die.sh, while a clean/benign netroot value round-tripped with identical warning text in every version tested. Replacing the manual echo/quoting with printf '%q' was verified to neutralize the injection while preserving identical warning output for benign input.

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials.

modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracutblockuuid.map.