A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dracutUpgrade dracut-config-rescueUpgrade dracut-config-genericUpgrade dracut-liveUpgrade dracut-toolsUpgrade dracut-capsUpgrade dracut-networkUpgrade dracut-squash | Jun 18, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dracut-toolsUpgrade dracutUpgrade dracut-config-genericUpgrade dracut-networkUpgrade dracut-fipsUpgrade dracut-capsUpgrade dracut-config-rescueUpgrade dracut-fips-aesniUpgrade dracut-debuginfo | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade dracut-debugsourceUpgrade dracut-toolsUpgrade dracut-debuginfoUpgrade dracut-capsUpgrade dracutUpgrade dracut-config-genericUpgrade dracut-config-rescueUpgrade dracut-squash | Jul 21, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Sep 11, 2026 | Jun 10, 2026 |
| Redhat_linux | — | Upgrade dracut-debugsourceUpgrade dracut-config-rescueUpgrade dracut-debuginfoUpgrade dracut-config-genericUpgrade dracutUpgrade dracut-fips-aesniNo solution existsUpgrade dracut-liveUpgrade dracut-squashUpgrade dracut-networkUpgrade dracut-capsUpgrade dracut-fipsUpgrade dracut-tools | Jun 19, 2026 | Jun 10, 2026 |
| Rocky_linux | — | Upgrade dracut-networkUpgrade dracut-config-rescueUpgrade dracut-debugsourceUpgrade dracut-config-genericUpgrade dracut-capsUpgrade dracut-squashUpgrade dracutUpgrade dracut-toolsUpgrade dracut-debuginfoUpgrade dracut-live | Jun 22, 2026 | Jun 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub