A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dracut-networkUpgrade dracut-capsUpgrade dracut-squashUpgrade dracut-toolsUpgrade dracut-config-rescueUpgrade dracutUpgrade dracut-liveUpgrade dracut-config-generic | Jun 18, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dracut-debuginfoUpgrade dracut-config-rescueUpgrade dracut-fips-aesniUpgrade dracut-capsUpgrade dracutUpgrade dracut-config-genericUpgrade dracut-networkUpgrade dracut-toolsUpgrade dracut-fips | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade dracut-config-rescueUpgrade dracut-config-genericUpgrade dracut-squashUpgrade dracutUpgrade dracut-toolsUpgrade dracut-debugsourceUpgrade dracut-capsUpgrade dracut-debuginfo | Jul 21, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 11, 2026 | Jun 10, 2026 |
| Redhat_linux | — | Upgrade dracutUpgrade dracut-config-genericUpgrade dracut-fips-aesniUpgrade dracut-debugsourceUpgrade dracut-config-rescueUpgrade dracut-debuginfoUpgrade dracut-liveUpgrade dracut-squashUpgrade dracut-fipsUpgrade dracut-toolsUpgrade dracut-networkUpgrade dracut-caps | Jun 19, 2026 | Jun 10, 2026 |
| Rocky_linux | — | Upgrade dracut-debugsourceUpgrade dracut-config-rescueUpgrade dracut-networkUpgrade dracut-config-genericUpgrade dracut-squashUpgrade dracutUpgrade dracut-liveUpgrade dracut-toolsUpgrade dracut-debuginfoUpgrade dracut-caps | Jun 22, 2026 | Jun 19, 2026 |
| Ubuntu | — | No solution existsUpgrade dracutUpgrade dracut (Ubuntu Pro)Upgrade dracut-network (Ubuntu Pro)Upgrade dracut-coreUpgrade dracut-networkUpgrade dracut-core (Ubuntu Pro) | Sep 29, 2026 | Sep 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub