A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dracut-squashUpgrade dracut-networkUpgrade dracut-capsUpgrade dracut-toolsUpgrade dracut-config-genericUpgrade dracut-config-rescueUpgrade dracutUpgrade dracut-live | Jun 18, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dracutUpgrade dracut-capsUpgrade dracut-config-genericUpgrade dracut-toolsUpgrade dracut-fipsUpgrade dracut-networkUpgrade dracut-fips-aesniUpgrade dracut-config-rescueUpgrade dracut-debuginfo | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade dracut-config-rescueUpgrade dracut-config-genericUpgrade dracutUpgrade dracut-squashUpgrade dracut-debuginfoUpgrade dracut-capsUpgrade dracut-toolsUpgrade dracut-debugsource | Jul 21, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Sep 11, 2026 | Jun 10, 2026 |
| Redhat_linux | — | Upgrade dracut-debuginfoUpgrade dracut-liveNo solution existsUpgrade dracutUpgrade dracut-config-genericUpgrade dracut-fips-aesniUpgrade dracut-debugsourceUpgrade dracut-config-rescueUpgrade dracut-toolsUpgrade dracut-squashUpgrade dracut-capsUpgrade dracut-networkUpgrade dracut-fips | Jun 19, 2026 | Jun 10, 2026 |
| Rocky_linux | — | Upgrade dracut-liveUpgrade dracut-debuginfoUpgrade dracut-capsUpgrade dracutUpgrade dracut-toolsUpgrade dracut-squashUpgrade dracut-networkUpgrade dracut-config-genericUpgrade dracut-debugsourceUpgrade dracut-config-rescue | Jun 22, 2026 | Jun 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub