A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade dracut-toolsUpgrade dracut-squashUpgrade dracut-capsUpgrade dracut-networkUpgrade dracut-liveUpgrade dracutUpgrade dracut-config-rescueUpgrade dracut-config-generic | Jun 18, 2026 | Jun 17, 2026 |
| Amazon Linux Ami 2 | — | Upgrade dracut-fips-aesniUpgrade dracut-config-rescueUpgrade dracut-debuginfoUpgrade dracut-toolsUpgrade dracut-fipsUpgrade dracut-capsUpgrade dracut-networkUpgrade dracut-config-genericUpgrade dracut | Jul 22, 2026 | Jul 22, 2026 |
| Amazon_linux_2023 | — | Upgrade dracut-debugsourceUpgrade dracut-capsUpgrade dracut-toolsUpgrade dracut-debuginfoUpgrade dracut-squashUpgrade dracutUpgrade dracut-config-genericUpgrade dracut-config-rescue | Jul 21, 2026 | Jun 10, 2026 |
| Redhat Openshift | — | Upgrade ose-rhel-coreos | Sep 11, 2026 | Jun 10, 2026 |
| Redhat_linux | — | Upgrade dracut-networkUpgrade dracut-fipsUpgrade dracut-squashUpgrade dracut-capsUpgrade dracut-toolsUpgrade dracutUpgrade dracut-liveUpgrade dracut-debuginfoUpgrade dracut-config-genericUpgrade dracut-debugsourceUpgrade dracut-config-rescueUpgrade dracut-fips-aesni | Jun 19, 2026 | Jun 10, 2026 |
| Rocky_linux | — | Upgrade dracut-debugsourceUpgrade dracut-config-genericUpgrade dracut-config-rescueUpgrade dracut-networkUpgrade dracut-capsUpgrade dracut-debuginfoUpgrade dracutUpgrade dracut-squashUpgrade dracut-toolsUpgrade dracut-live | Jun 22, 2026 | Jun 19, 2026 |
| Ubuntu | — | Upgrade dracut-network (Ubuntu Pro)Upgrade dracutUpgrade dracut (Ubuntu Pro)Upgrade dracut-coreNo solution existsUpgrade dracut-networkUpgrade dracut-core (Ubuntu Pro) | Sep 29, 2026 | Sep 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub