Description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dracut | 112-1 | — |
| Debian 13 | dracut | No fix yet | — |
| Debian 12 | dracut | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | dracut | 110-11ubuntu0.1 | USN-8828-1 |
| Ubuntu 25.10 | dracut | No fix yet | — |
| Ubuntu 24.04 LTS | dracut | 060+5-1ubuntu3.4 | USN-8828-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | dracut | 051-1ubuntu0.1~esm1 | USN-8828-1 |
| Ubuntu Pro 20.04 LTS | dracut | 048+80-2ubuntu0.1~esm1 | USN-8828-1 |
| Ubuntu Pro 18.04 LTS | dracut | 047-2ubuntu0.1~esm1 | USN-8828-1 |
| Ubuntu Pro 16.04 LTS | dracut | 044+3-3ubuntu0.1~esm1 | USN-8828-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | dracut +7 | 107-7.el10_2 | RHSA-2026:26532 |
| RHEL 9 | dracut +7 | 057-115.git20260527.el9_8 | RHSA-2026:26533 |
| RHEL 8 | dracut +7 | 049-244.git20260529.el8_10 | RHSA-2026:26534 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | dracut +1 | 105-4.el10_0.1 | RHSA-2026:57580 |
| RHEL 9.6 EUS | dracut +1 | 057-89.git20250311.el9_6.1 | RHSA-2026:57772 |
| RHEL 9.4 E4S | dracut +1 | 057-54.git20250423.el9_4.3 | RHSA-2026:57785 |
| RHEL 9.2 E4S | dracut +1 | 057-25.git20250717.el9_2.2 | RHSA-2026:57775 |
| RHEL 8.8 TUS | dracut +1 | 049-223.git20230119.el8_8.1 | RHSA-2026:61252 |
| RHEL 8.8 E4S | dracut +1 | 049-223.git20230119.el8_8.1 | RHSA-2026:61252 |
| RHEL 8.6 EUS Long Life | dracut +7 | 049-203.git20220511.el8_6.1 | RHSA-2026:69119 |
| RHEL 8.6 AUS | dracut +7 | 049-203.git20220511.el8_6.1 | RHSA-2026:69119 |
| RHEL 8.4 EUS Long Life | dracut +7 | 049-138.git20220131.el8_4.1 | RHSA-2026:69118 |
| RHEL 8.4 AUS | dracut +7 | 049-138.git20220131.el8_4.1 | RHSA-2026:69118 |
| RHEL 7 ELS | dracut +1 | 033-577.el7_9 | RHSA-2026:62269 |
| RHEL 6 ELS | dracut +7 | 004-413.el6_10 | RHSA-2026:79114, RHSA-2026:74499 |
| Red Hat Hardened Images 1 | dracut +7 | 109-6.hum1 | RHSA-2026:26713 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | dracut +7 | 107-7.el10_2 | ALSA-2026:26532 |
| AlmaLinux 9 | dracut +7 | 057-115.git20260527.el9_8 | ALSA-2026:26533 |
| AlmaLinux 8 | dracut +7 | 049-244.git20260529.el8_10 | ALSA-2026:26534 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | dracut | 107-7.el10_2 | RLSA-2026:26532 |
| Rocky Linux 9 | dracut | 057-115.git20260527.el9_8 | RLSA-2026:26533 |
| Rocky Linux 8 | dracut | 049-244.git20260529.el8_10 | RLSA-2026:26534 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | dracut | 059+suse.570.g2b84048d7-150700.3.17.1 | SUSE-SU-2026:3931-1, SUSE-SU-2026:2851-1 |
| SLES 15 SP6 | dracut | 059+suse.565.g682306ec5-150600.3.29.1 | SUSE-SU-2026:3997-1, SUSE-SU-2026:2803-1 |
| SLES 15 SP5 | dracut | 055+suse.402.g2720eea-150500.3.41.1 | SUSE-SU-2026:4079-1, SUSE-SU-2026:2721-1 |
| SLES 15 SP4 | dracut | 055+suse.365.g79144c5-150400.3.49.1 | SUSE-SU-2026:4078-1, SUSE-SU-2026:2720-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | dracut | 059+suse.722.gdd9d67ff5-160000.1.1 | SUSE-SU-2026:23614-1, SUSE-SU-2026:22358-1 |
| SLES for SAP 15 SP6 | dracut | 059+suse.565.g682306ec5-150600.3.29.1 | SUSE-SU-2026:3997-1, SUSE-SU-2026:2803-1 |
| SLES for SAP 15 SP5 | dracut | 055+suse.402.g2720eea-150500.3.41.1 | SUSE-SU-2026:4079-1, SUSE-SU-2026:2721-1 |
| SLES for SAP 15 SP4 | dracut | 055+suse.365.g79144c5-150400.3.49.1 | SUSE-SU-2026:4078-1, SUSE-SU-2026:2720-1 |
| SLES 16.0 | dracut | 059+suse.722.gdd9d67ff5-160000.1.1 | SUSE-SU-2026:23614-1, SUSE-SU-2026:22358-1 |
| SLE Micro 6.2 | dracut | 059+suse.722.gdd9d67ff5-160000.1.1 | SUSE-SU-2026:23466-1, SUSE-SU-2026:22273-1 |
| SLE Micro 6.1 | dracut | 059+suse.643.g1f1d880-slfo.1.1_1.1 | SUSE-SU-2026:23513-1, SUSE-SU-2026:22446-1 |
| SLE Micro 6.0 | dracut | 059+suse.609.g1a2492e-1.1 | SUSE-SU-2026:23444-1, SUSE-SU-2026:22431-1 |
| SLE Micro 5.5 | dracut | 055+suse.402.g2720eea-150500.3.41.1 | SUSE-SU-2026:4079-1, SUSE-SU-2026:2721-1 |
| SLE Micro 5.4 | dracut | 055+suse.365.g79144c5-150400.3.49.1 | SUSE-SU-2026:4078-1, SUSE-SU-2026:2720-1 |
| SLE Micro 5.3 | dracut | 055+suse.365.g79144c5-150400.3.49.1 | SUSE-SU-2026:4078-1, SUSE-SU-2026:2720-1 |
| SLE HPC 15 SP5 | dracut | 055+suse.402.g2720eea-150500.3.41.1 | SUSE-SU-2026:4079-1, SUSE-SU-2026:2721-1 |
| SLE HPC 15 SP4 | dracut | 055+suse.365.g79144c5-150400.3.49.1 | SUSE-SU-2026:4078-1, SUSE-SU-2026:2720-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dracut | 110+suse.35.g9834432-1.1 | openSUSE-SU-2026:11076-1 |
| openSUSE Leap 16.0 | dracut | 059+suse.722.gdd9d67ff5-160000.1.1 | openSUSE-SU-2026:21749-1, openSUSE-SU-2026:21054-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | dracut +5 | 102-3.amzn2023.0.3 | ALAS2023-2026-1965 |
| Amazon Linux 2 | dracut +7 | 033-535.amzn2.1.7 | ALAS2-2026-3812 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | dracut | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | dracut +7 | 107-8.0.1.el10_2 | ELSA-2026-26532 |
| Oracle Linux 9 | dracut +7 | 057-115.git20260527.0.1.el9_8 | ELSA-2026-26533 |
| Oracle Linux 8 | dracut +7 | 049-244.git20260529.0.1.el8_10 | ELSA-2026-26534 |
Advisories 46
- ALSA-2026:26533 Important: dracut security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26532 Important: dracut security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26534 Important: dracut security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1977 Red Hat Enterprise Linux (dracut): Schwachstelle ermöglicht Ausführen von beliebigem Programmcode mit Administratorrechten BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2026:79114 Red Hat Security Advisory: dracut security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:74499 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69118 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:69119 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:62269 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:61252 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:57785 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:57772 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:57775 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:57580 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:26534 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:26533 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:26532 Red Hat Security Advisory: dracut security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2026:26713 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- SUSE-SU-2026:23614-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 29, 2026
- USN-8828-1 dracut vulnerabilities Ubuntu Security Notices (USN) · Sep 28, 2026
- SUSE-SU-2026:23513-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 15, 2026
- SUSE-SU-2026:23466-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:23444-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 14, 2026
- SUSE-SU-2026:4078-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:4079-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:3997-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 13, 2026
- SUSE-SU-2026:3931-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 10, 2026
- openSUSE-SU-2026:21749-1 Security update for dracut SUSE / openSUSE Security Updates · Sep 9, 2026
- ALAS2-2026-3812 Important: dracut security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- ALAS2023-2026-1965 Important: dracut security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 20, 2026
- ELSA-2026-26532 Important: dracut security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 20, 2026
- SUSE-SU-2026:2851-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 11, 2026
- SUSE-SU-2026:2803-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22446-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 4, 2026
- SUSE-SU-2026:22431-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 3, 2026
- SUSE-SU-2026:22358-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:2721-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:2720-1 Security update for dracut SUSE / openSUSE Security Updates · Jul 2, 2026
- SUSE-SU-2026:22273-1 Security update for dracut SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:21054-1 Security update for dracut SUSE / openSUSE Security Updates · Jun 30, 2026
- openSUSE-SU-2026:11076-1 dracut-110+suse.35.g9834432-1.1 on GA media SUSE / openSUSE Security Updates · Jun 24, 2026
- ELSA-2026-26533 Important: dracut security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- RLSA-2026:26532 Important: dracut security update Rocky Linux Security Advisories · Jun 19, 2026
- RLSA-2026:26533 Important: dracut security update Rocky Linux Security Advisories · Jun 19, 2026
- RLSA-2026:26534 Important: dracut security update Rocky Linux Security Advisories · Jun 19, 2026
- ELSA-2026-26534 Important: dracut security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 17, 2026
References
- RHSA-2026:26532 vendor-advisory
- RHSA-2026:26533 vendor-advisory
- RHSA-2026:26534 vendor-advisory
- RHSA-2026:26713 vendor-advisory
- RHSA-2026:57580 vendor-advisory
- RHSA-2026:57772 vendor-advisory
- RHSA-2026:57775 vendor-advisory
- RHSA-2026:57785 vendor-advisory
- RHSA-2026:61252 vendor-advisory
- RHSA-2026:62269 vendor-advisory
- RHSA-2026:62409 vendor-advisory
- RHSA-2026:62549 vendor-advisory
- RHSA-2026:63044 vendor-advisory
- RHSA-2026:65839 vendor-advisory
- RHSA-2026:65851 vendor-advisory
- RHSA-2026:67857 vendor-advisory
- RHSA-2026:69118 vendor-advisory
- RHSA-2026:69119 vendor-advisory
- RHSA-2026:70586 vendor-advisory
- RHSA-2026:70615 vendor-advisory
- RHSA-2026:74499 vendor-advisory
- RHSA-2026:79114 vendor-advisory
- RHSA-2026:90272 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-6893 vdb-entry
- RHBZ#2459963 issue-tracking