The vulnerability arises when the die() function in dracut writes its error message into a shell script under the initramfs emergency‑hook directory without properly escaping it. If the message contains data supplied by the DHCP ROOT_PATH option, an attacker controlling a rogue DHCP server can inject a command‑substitution sequence that is executed as root when dracut sources emergency hook scripts during a boot failure. This allows the attacker to run arbitrary commands with root privileges after a system crash, leading to full compromise of the affected machine.

Red Hat Enterprise Linux 10, 6, 7, 8, 9, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are affected. The flaw resides in the dracut component used by these products.

The CVSS score is 7.5, indicating a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to control the DHCP server on the network that provides network boot or boot‑failure support. By setting the DHCP ROOT_PATH to a value that includes command substitution, the attacker can execute arbitrary shell commands as root during the next boot‑failure handling event.