CVE-2026-16445

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.(CVE-2026-16445)

dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.

Security Fix(es):

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.(CVE-2026-16445)

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.

These are all security issues fixed in the dracut-112+suse.47.gec0b378-1.1 package on the GA media of openSUSE Tumbleweed.

This update for dracut fixes the following issues:

Update to version 059+suse.730.g73d3411aa.

• CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs (bsc#1268322).
• CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs during system boot (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.730.g73d3411aa:
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
  • fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

• CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).
• CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.615.g018c5a4:

• fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
• fix(network-legacy): strip DHCP-supplied domain to a safe charset
• fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts

This update for dracut fixes the following issues:

Update to version 059+suse.730.g73d3411aa.

• CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs (bsc#1268322).
• CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs during system boot (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.730.g73d3411aa:
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
  • fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

• CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).
• CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.649.g0274006:

• fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
• fix(network-legacy): strip DHCP-supplied domain to a safe charset
• fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts

This update for dracut fixes the following issues:

Update to version 059+suse.730.g73d3411aa.

• CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs (bsc#1268322).
• CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs during system boot (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.730.g73d3411aa:
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
  • fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

• CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).
• CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.576.g72b98359a:

• fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
• fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

Update to version 059+suse.730.g73d3411aa.

• CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs (bsc#1268322).
• CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution within the initramfs during system boot (bsc#1273580).

Changes for dracut:

• Update to version 059+suse.730.g73d3411aa:
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
  • fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
  • fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

• CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).
• CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).

Changes for dracut:

• Update to version 055+suse.371.g92f67c2:

• fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
• fix(network-legacy): strip DHCP-supplied domain to a safe charset

This update for dracut fixes the following issues:

• CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).
• CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).

Changes for dracut:

• Update to version 055+suse.408.g34171a9:

• fix(network-legacy): sanitize values written to /tmp/net.${netif}.override
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw
• fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname
• fix(network-legacy): strip DHCP-supplied domain to a safe charset

It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637)

It was discovered that dracut did not properly sanitize DHCP options before writing them to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)

It was discovered that dracut did not properly quote error messages written to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-15816)

It was discovered that dracut did not properly sanitize network configuration data before writing it to a temporary shell script under certain circumstances. A remote attacker controlling DHCP on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 22.04 LTS. (CVE-2026-16445)