From 70fadfc15d0710c4427d5ddd2d76234767d41b1e Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Thu, 13 Aug 2026 19:48:50 +0200
Subject: [PATCH] dracut: fix CVE-2026-15816

Backport the upstream fix to dracut 059 together with its required escape helper. Adapt both patches to the older modules.d/99base path.

Not-cherry-picked-because: release-26.05 uses dracut 059 and requires separate patches
Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/by-name/dr/dracut/package.nix | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pkgs/by-name/dr/dracut/package.nix b/pkgs/by-name/dr/dracut/package.nix
index 2dcac697dc05..3a05313aa796 100644
--- a/pkgs/by-name/dr/dracut/package.nix
+++ b/pkgs/by-name/dr/dracut/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   gitUpdater,
   makeBinaryWrapper,
   pkg-config,
@@ -38,6 +39,32 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-zSyC2SnSQkmS/mDpBXG2DtVVanRRI9COKQJqYZZCPJM=";
   };
 
+  patches = [
+    # dracut-lib.sh moved from 99base to 80base after 059.
+    # Required by the CVE-2026-15816 fix below; remove when updating to 112 or newer.
+    (fetchpatch2 {
+      name = "add-escape-function.patch";
+      url = "https://github.com/dracut-ng/dracut/commit/207c339728eff81127469c2f6fe106447c781009.patch?full_index=1";
+      relative = "modules.d/80base";
+      extraPrefix = "modules.d/99base/";
+      hash = "sha256-r8dsJvmb09QH6ZRTceBg3Bo+WbCKA8U7Pj0rAjXDcm4=";
+    })
+    # Remove when updating to the first release after 112 containing this fix.
+    (fetchpatch2 {
+      name = "CVE-2026-15816.patch";
+      url = "https://github.com/dracut-ng/dracut/commit/c4d555716d569038ca38365741e94ee07908f261.patch?full_index=1";
+      relative = "modules.d/80base";
+      extraPrefix = "modules.d/99base/";
+      hash = "sha256-ja15T++ojzjExRgPjyyuUx/vkLhR9AWBBWgz9hTzHCU=";
+    })
+  ];
+
+  # Don't create .orig files when the backported patches apply with offsets.
+  patchFlags = [
+    "--no-backup-if-mismatch"
+    "-p1"
+  ];
+
   strictDeps = true;
 
   buildInputs = [