{"id":"CVE-2026-16445","aliases":["BELL-CVE-2026-16445","DEBIAN-CVE-2026-16445","EUVD-2026-46253","GHSA-4672-282m-8fgr","OESA-2026-3300","OESA-2026-3301","RHSA-2026:26534","RHSA-2026:40700","RHSA-2026:61252","RHSA-2026:69118","RHSA-2026:69119","SUSE-SU-2026:23444-1","SUSE-SU-2026:23466-1","SUSE-SU-2026:23513-1","SUSE-SU-2026:23614-1","SUSE-SU-2026:3931-1","SUSE-SU-2026:3997-1","SUSE-SU-2026:4078-1","SUSE-SU-2026:4079-1","UBUNTU-CVE-2026-16445","USN-8828-1","openSUSE-SU-2026:11657-1","openSUSE-SU-2026:21749-1"],"status":"published","title":"Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03222,"percentile":0.88395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2026-06-18T10:09:48Z","modified":"2026-11-05T21:16:05Z","fixes":[{"ecosystem":"Debian:14","package":"dracut","fixed_in":["112-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"dracut","fixed_in":["050-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"dracut","fixed_in":["055-19.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-caps","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-config-generic","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-config-rescue","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-live","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-network","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-squash","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"dracut-tools","fixed_in":["0:109-7.hum1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dracut","fixed_in":["051-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dracut","fixed_in":["112+suse.47.gec0b378-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["059+212-1","059+212-2","059+212-3","059+212-4","059-4","060+5-1","060+5-2~exp1","060+5-7","060+5-8","102-1","102-2","102-3","103-1","103-1.1","103-2","105-1","105-2","105-2~exp1","105-2~exp2","105-2~exp3","105-2~exp4","105-2~exp5","105-2~exp6","105-2~exp7","105-2~exp8","105-3","106-1","106-2","106-3","106-4","106-5","106-5~bpo12+1","106-6","107-1","107-2","108-1","108-2","108-3","108-4","108-5","108-6","108-7","108-8","109-1","109-10","109-11","109-1exp1","109-2","109-3","109-4","109-5","109-6","109-6exp1","109-6exp2","109-6exp3","109-7","109-8","109-9","110-1","110-10","110-11","110-12","110-2","110-3","110-4","110-5","110-6","110-7","110-8","110-9","111-1","111-2","111-3","111-4","111-5","111-6","112-1","112-2","112-3","112-4","112-5","112-6","112-7","112-8"]},{"source":"osv","ecosystem":"Debian:13","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["106-6","107-1","107-2","108-1","108-2","108-3","108-4","108-5","108-6","108-7","108-8","109-1","109-10","109-11","109-1exp1","109-2","109-3","109-4","109-5","109-6","109-6exp1","109-6exp2","109-6exp3","109-7","109-8","109-9","110-1","110-10","110-11","110-12","110-2","110-3","110-4","110-5","110-6","110-7","110-8","110-9","111-1","111-2","111-3","111-4","111-5","111-6","112-1","112-2","112-3","112-4","112-5","112-6","112-7","112-8"]},{"source":"osv","ecosystem":"Debian:14","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"112-1"}]}],"versions":["106-6","107-1","107-2","108-1","108-2","108-3","108-4","108-5","108-6","108-7","108-8","109-1","109-10","109-11","109-1exp1","109-2","109-3","109-4","109-5","109-6","109-6exp1","109-6exp2","109-6exp3","109-7","109-8","109-9","110-1","110-10","110-11","110-12","110-2","110-3","110-4","110-5","110-6","110-7","110-8","110-9","111-1","111-2","111-3","111-4","111-5","111-6"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"050-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055-19.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-244.git20260529.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:109-7.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-223.git20230119.el8_8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-223.git20230119.el8_8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-223.git20230119.el8_8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-223.git20230119.el8_8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-138.git20220131.el8_4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-caps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-config-generic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-config-rescue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-live","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-network","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-squash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::baseos","package":"dracut-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:049-203.git20220511.el8_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.615.g018c5a4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.730.g73d3411aa-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.649.g0274006-slfo.1.1_1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.730.g73d3411aa-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.730.g73d3411aa-160000.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.576.g72b98359a-150700.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP7","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.576.g72b98359a-150700.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP6","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.571.g3d42218af-150600.3.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.571.g3d42218af-150600.3.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.571.g3d42218af-150600.3.35.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.371.g92f67c2-150400.3.55.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.408.g34171a9-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.408.g34171a9-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.408.g34171a9-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.408.g34171a9-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"055+suse.408.g34171a9-150500.3.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"051-1ubuntu0.1~esm1"}]}],"versions":["051-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"044+3-3ubuntu0.1~esm1"}]}],"versions":["043-2","043-4","044+3-1","044+3-2","044+3-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"047-2ubuntu0.1~esm1"}]}],"versions":["045+132-1","047-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"048+80-2ubuntu0.1~esm1"}]}],"versions":["048+80-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"051-1ubuntu0.1~esm1"}]}],"versions":["051-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"060+5-1ubuntu3.4"}]}],"versions":["059-4ubuntu2","060+5-1ubuntu1","060+5-1ubuntu2","060+5-1ubuntu3","060+5-1ubuntu3.1","060+5-1ubuntu3.2","060+5-1ubuntu3.3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"110-11ubuntu0.1"}]}],"versions":["108-3ubuntu3","108-8ubuntu1","109-5ubuntu1","109-7ubuntu1","109-9ubuntu1","109-11ubuntu1","110-1ubuntu2","110-3ubuntu1","110-5","110-7","110-10","110-11"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"112+suse.47.gec0b378-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"059+suse.730.g73d3411aa-160000.1.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:26534","tags":["vendor-advisory","x_refsource_REDHAT","advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40700","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61252","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69118","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69119","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:90272","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16445","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503147","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/dracutdevs/dracut/commit/e509c638e6","tags":["fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16445","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4672-282m-8fgr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-16445","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://catalog.redhat.com/software/containers/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16445.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-16445","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3300","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3301","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26534.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6893","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16445","tags":["advisory","report"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40700.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500889","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_61252.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15816","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15816","tags":["advisory"]},{"url":"https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh","tags":["article"]},{"url":"https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69118.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69119.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623444-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268322","tags":["report"]},{"url":"https://bugzilla.suse.com/1273580","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6893","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623466-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623513-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623614-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263931-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263997-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264078-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264079-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-16445","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8828-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-8637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6893","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15816","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-16445","title":"Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T12:51:08.65Z","modified":"2026-11-04T22:02:47.042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-46253","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T12:51:08Z","modified":"2026-11-04T22:02:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T23:47:18.620008Z"}],"ghsa":[{"id":"GHSA-4672-282m-8fgr","title":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this...","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T15:30:43Z","modified":"2026-10-28T00:31:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:14:32.579072Z"}],"nvd":[{"id":"CVE-2026-16445","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T13:17:16.73Z","modified":"2026-11-04T22:18:00.123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-04T23:43:39.147797Z"}],"osv":[{"id":"BELL-CVE-2026-16445","title":"CVE-2026-16445 does not affect BellSoft software","status":"withdrawn","published":"2026-07-22T06:04:07.823437Z","modified":"2026-07-29T07:30:07.138055487Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-16445","title":"Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T12:51:08.65Z","modified":"2026-11-05T21:16:05.483573759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-05T22:00:58.054534Z"},{"id":"DEBIAN-CVE-2026-16445","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T13:17:16.73Z","modified":"2026-11-05T10:00:24.552825093Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-3300","title":"dracut security update","description":"dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut\u0026apos;s NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.(CVE-2026-16445)","status":"published","published":"2026-08-07T02:44:54Z","modified":"2026-08-07T03:00:59.01259181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3301","title":"dracut security update","description":"dracut contains tools to create bootable initramfses for the Linux kernel. Unlike previous implementations, dracut hard-codes as little as possible into the initramfs. dracut contains various modules which are driven by the event-based udev. Having root on MD, DM, LVM2, LUKS is supported as well as NFS, iSCSI, NBD, FCoE with the dracut-network package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut\u0026apos;s NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.(CVE-2026-16445)","status":"published","published":"2026-08-07T02:44:55Z","modified":"2026-08-07T03:00:59.268408397Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:26534","title":"Red Hat Security Advisory: dracut security update","status":"published","published":"2026-06-18T10:09:48Z","modified":"2026-10-15T10:15:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:40700","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-07-23T10:13:16Z","modified":"2026-10-06T10:31:23.511597801Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:61252","title":"Red Hat Security Advisory: dracut security update","status":"published","published":"2026-08-31T10:12:10Z","modified":"2026-10-15T10:22:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:69118","title":"Red Hat Security Advisory: dracut security update","status":"published","published":"2026-09-21T10:14:52Z","modified":"2026-10-15T10:24:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69119","title":"Red Hat Security Advisory: dracut security update","status":"published","published":"2026-09-21T10:14:53Z","modified":"2026-10-15T10:24:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"UBUNTU-CVE-2026-16445","description":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.","status":"published","published":"2026-07-21T13:17:00Z","modified":"2026-09-28T22:45:15.073707639Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"openSUSE-SU-2026:11657-1","title":"dracut-112+suse.47.gec0b378-1.1 on GA media","description":"These are all security issues fixed in the dracut-112+suse.47.gec0b378-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-01T00:00:00Z","modified":"2026-09-02T11:15:03.87009363Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21749-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\nUpdate to version 059+suse.730.g73d3411aa.\n\n- CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` (bsc#1268322).\n- CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` during system boot (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.730.g73d3411aa:\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n  * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-03T16:40:31Z","modified":"2026-09-09T18:23:13.698750288Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23444-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\n- CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).\n- CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.615.g018c5a4:\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n * fix(network-manager): ensure safe content of /tmp/dhclient.\"$ifname\".dhcpopts\n","status":"published","published":"2026-09-02T09:30:06Z","modified":"2026-09-14T18:23:11.156854255Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23466-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\nUpdate to version 059+suse.730.g73d3411aa.\n\n- CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` (bsc#1268322).\n- CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` during system boot (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.730.g73d3411aa:\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n  * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-03T16:40:48Z","modified":"2026-09-14T18:23:12.181900207Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23513-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\n- CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).\n- CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.649.g0274006:\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n * fix(network-manager): ensure safe content of /tmp/dhclient.\"$ifname\".dhcpopts\n","status":"published","published":"2026-09-02T09:14:58Z","modified":"2026-09-15T18:23:08.85793447Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23614-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\nUpdate to version 059+suse.730.g73d3411aa.\n\n- CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` (bsc#1268322).\n- CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` during system boot (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.730.g73d3411aa:\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n  * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-03T16:40:48Z","modified":"2026-09-29T18:23:19.805056698Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3931-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\n- CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).\n- CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.576.g72b98359a:\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-03T07:19:33Z","modified":"2026-09-10T18:23:17.850013684Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3997-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\nUpdate to version 059+suse.730.g73d3411aa.\n\n- CVE-2026-6893: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` (bsc#1268322).\n- CVE-2026-16445: improper handling and escaping of DHCP options can lead to command injection and root code execution\n  within the `initramfs` during system boot (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 059+suse.730.g73d3411aa:\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n  * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n  * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-07T07:23:02Z","modified":"2026-09-13T18:23:14.202748799Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4078-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\n- CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).\n- CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 055+suse.371.g92f67c2:\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-08T07:13:23Z","modified":"2026-09-13T18:23:22.558708563Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4079-1","title":"Security update for dracut","description":"This update for dracut fixes the following issues:\n\n- CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).\n- CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580).\n\nChanges for dracut:\n\n- Update to version 055+suse.408.g34171a9:\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw\n * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname\n * fix(network-legacy): strip DHCP-supplied domain to a safe charset\n","status":"published","published":"2026-09-08T07:14:09Z","modified":"2026-09-13T18:23:21.645593157Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8828-1","title":"dracut vulnerabilities","description":"It was discovered that dracut created initramfs images with overly\npermissive permissions under certain circumstances. A local attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 16.04 LTS. (CVE-2016-8637)\n\nIt was discovered that dracut did not properly sanitize DHCP options\nbefore writing them to shell scripts under certain circumstances. A remote\nattacker controlling a DHCP server on the local network could possibly use\nthis issue to execute arbitrary code as root during system boot. This issue\nonly affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)\n\nIt was discovered that dracut did not properly quote error messages written\nto shell scripts under certain circumstances. A remote attacker controlling\na DHCP server on the local network could possibly use this issue to execute\narbitrary code as root during system boot. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2026-15816)\n\nIt was discovered that dracut did not properly sanitize network\nconfiguration data before writing it to a temporary shell script under\ncertain circumstances. A remote attacker controlling DHCP on the local\nnetwork could possibly use this issue to execute arbitrary code as root\nduring system boot. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2026-16445)","status":"published","published":"2026-09-28T13:33:37Z","modified":"2026-09-28T22:57:43.497701288Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}