UnratedFix available

dracut vulnerabilities

Type: advisorySource: OSV1 source record

It was discovered that dracut created initramfs images with overly permissive permissions under certain circumstances. A local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-8637) It was discovered that dracut did not properly sanitize DHCP options before writing them to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893) It was discovered that dracut did not properly quote error messages written to shell scripts under certain circumstances. A remote attacker controlling a DHCP server on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-15816) It was discovered that dracut did not properly sanitize network configuration data before writing it to a temporary shell script under certain circumstances. A remote attacker controlling DHCP on the local network could possibly use this issue to execute arbitrary code as root during system boot. This issue only affected Ubuntu 22.04 LTS. (CVE-2026-16445)

Announced 28 Sept 2026Source revision 1

Original source ↗

USN-8828-1

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:USN-8828-1

dracut

Source reference: /affected/0/package/name

Affected versions: 043-2
Source reference: /affected/0/versions
043-4
Source reference: /affected/0/versions
044+3-1
Source reference: /affected/0/versions
044+3-2
Source reference: /affected/0/versions
044+3-3
Source reference: /affected/0/versions
Fixed versions: 044+3-3ubuntu0.1~esm1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/1/package/name

Affected versions: 045+132-1
Source reference: /affected/1/versions
047-2
Source reference: /affected/1/versions
Fixed versions: 047-2ubuntu0.1~esm1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/2/package/name

Affected versions: 048+80-2
Source reference: /affected/2/versions
Fixed versions: 048+80-2ubuntu0.1~esm1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/3/package/name

Affected versions: 051-1
Source reference: /affected/3/versions
Fixed versions: 051-1ubuntu0.1~esm1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/4/package/name

Affected versions: 059-4ubuntu2
Source reference: /affected/4/versions
060+5-1ubuntu1
Source reference: /affected/4/versions
060+5-1ubuntu2
Source reference: /affected/4/versions
060+5-1ubuntu3
Source reference: /affected/4/versions
060+5-1ubuntu3.1
Source reference: /affected/4/versions
060+5-1ubuntu3.2
Source reference: /affected/4/versions
060+5-1ubuntu3.3
Source reference: /affected/4/versions
Fixed versions: 060+5-1ubuntu3.4
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/5/package/name

Affected versions: 108-3ubuntu3
Source reference: /affected/5/versions
108-8ubuntu1
Source reference: /affected/5/versions
109-5ubuntu1
Source reference: /affected/5/versions
109-7ubuntu1
Source reference: /affected/5/versions
109-9ubuntu1
Source reference: /affected/5/versions
109-11ubuntu1
Source reference: /affected/5/versions
110-1ubuntu2
Source reference: /affected/5/versions
110-3ubuntu1
Source reference: /affected/5/versions
110-5
Source reference: /affected/5/versions
110-7
Source reference: /affected/5/versions
110-10
Source reference: /affected/5/versions
110-11
Source reference: /affected/5/versions
Fixed versions: 110-11ubuntu0.1
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "044+3-3ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "043-2",
      "043-4",
      "044+3-1",
      "044+3-2",
      "044+3-3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2016-8637",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
              },
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-6893",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:16.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "047-2ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "045+132-1",
      "047-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6893",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:18.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "047-2ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "048+80-2ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "048+80-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6893",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:20.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "051-1ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Fjammy",
      "ecosystem": "Ubuntu:Pro:22.04:LTS"
    },
    "versions": [
      "051-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6893",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-16445",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:Pro:22.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-live",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-squash",
          "binary_version": "051-1ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "060+5-1ubuntu3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "059-4ubuntu2",
      "060+5-1ubuntu1",
      "060+5-1ubuntu2",
      "060+5-1ubuntu3",
      "060+5-1ubuntu3.1",
      "060+5-1ubuntu3.2",
      "060+5-1ubuntu3.3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-6893",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          },
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:24.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-install",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-live",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-squash",
          "binary_version": "060+5-1ubuntu3.4"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "110-11ubuntu0.1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=resolute",
      "ecosystem": "Ubuntu:26.04:LTS"
    },
    "versions": [
      "108-3ubuntu3",
      "108-8ubuntu1",
      "109-5ubuntu1",
      "109-7ubuntu1",
      "109-9ubuntu1",
      "109-11ubuntu1",
      "110-1ubuntu2",
      "110-3ubuntu1",
      "110-5",
      "110-7",
      "110-10",
      "110-11"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8828-1.json",
      "cves_map": {
        "cves": [
          {
            "id": "CVE-2026-15816",
            "severity": [
              {
                "type": "CVSS_V3",
                "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
              },
              {
                "type": "Ubuntu",
                "score": "medium"
              }
            ]
          }
        ],
        "ecosystem": "Ubuntu:26.04:LTS"
      }
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "110-11ubuntu0.1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "110-11ubuntu0.1"
        },
        {
          "binary_name": "dracut-install",
          "binary_version": "110-11ubuntu0.1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "110-11ubuntu0.1"
        },
        {
          "binary_name": "dracut-test",
          "binary_version": "110-11ubuntu0.1"
        }
      ],
      "availability": "No subscription required"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #23745 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:24:06 GMT
Publisher date: Mon, 28 Sep 2026 13:33:37 GMT

Read the original announcement