VDB

RHSA-2026:57772

RHSA-2026:57772 PUBLISHED CVSS 7.5 HIGH

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red Hatdracut-squash-0:057-89.git20250311.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-tools-0:057-89.git20250311.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-config-rescue-0:057-89.git20250311.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-debuginfo-0:057-89.git20250311.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-config-generic-0:057-89.git20250311.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-caps-0:057-89.git20250311.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)6.1
Red Hatdracut-debuginfo-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-network-0:057-89.git20250311.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-live-0:057-89.git20250311.el9_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)6.1
Red Hatdracut-live-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)6.1
Red Hatdracut-config-generic-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-debuginfo-0:057-89.git20250311.el9_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)6.1
Red Hatdracut-debugsource-0:057-89.git20250311.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-tools-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-squash-0:057-89.git20250311.el9_6.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-debuginfo-0:057-89.git20250311.el9_6.1.s390x as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-squash-0:057-89.git20250311.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-0:057-89.git20250311.el9_6.1.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1
Red Hatdracut-config-generic-0:057-89.git20250311.el9_6.1.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.6)6.1

…and 29 more

Timeline

  • Aug 20, 2026 CVE Published
  • Sep 1, 2026 CVE Updated
  • Sep 1, 2026 Distribution Patch
  • Sep 1, 2026 Distribution Patch
  • Sep 1, 2026 Security Advisory
  • Sep 1, 2026 Security Advisory
  • Sep 1, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›