CVE catalog
CVE-2026-16445
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfil
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 3.14% · Oct 25, 2026
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | dracut | sid | 112-7 | fixed |
| Debian | dracut | forky | 112-7 | fixed |
| Debian | dracut | trixie | 106-6 | vulnerable |
| Debian | dracut | bookworm | 059-4 | vulnerable |
| Cpe | dracut | Not reported | Not reported | vulnerable |
| Ubuntu | dracut | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-config-generic | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-config-rescue | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-core | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-install | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-live | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-network | noble | 060+5-1ubuntu3.4 | fixed |
| Ubuntu | dracut-squash | noble | 060+5-1ubuntu3.4 | fixed |
| Suse | dracut | linux enterprise server 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | fixed |
| Suse | dracut | linux enterprise server for sap applications 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | fixed |
| Ubuntu | dracut | pro | 051-1 | vulnerable |
| Ubuntu | dracut | pro | 051-1ubuntu0.1~esm1 | fixed |
| Suse | dracut | linux micro 6.1 | 059+suse.649.g0274006-slfo.1.1_1.1 | fixed |
| Suse | dracut | linux micro 6.2 | 059+suse.730.g73d3411aa-160000.1.1 | fixed |
| Suse | dracut | linux micro 6.0 | 059+suse.615.g018c5a4-1.1 | fixed |
| Suse | dracut | linux enterprise micro 5.3 | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise micro 5.4 | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise high performance computing 15 sp4-espos | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise high performance computing 15 sp4-ltss | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise server 15 sp4-ltss | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise server for sap applications 15 sp4 | 055+suse.371.g92f67c2-150400.3.55.1 | fixed |
| Suse | dracut | linux enterprise micro 5.5 | 055+suse.408.g34171a9-150500.3.47.1 | fixed |
| Suse | dracut | linux enterprise high performance computing 15 sp5-espos | 055+suse.408.g34171a9-150500.3.47.1 | fixed |
| Suse | dracut | linux enterprise high performance computing 15 sp5-ltss | 055+suse.408.g34171a9-150500.3.47.1 | fixed |
| Suse | dracut | linux enterprise server 15 sp5-ltss | 055+suse.408.g34171a9-150500.3.47.1 | fixed |
| Suse | dracut | linux enterprise server for sap applications 15 sp5 | 055+suse.408.g34171a9-150500.3.47.1 | fixed |
| Suse | dracut | linux enterprise high availability extension 15 sp6 | 059+suse.571.g3d42218af-150600.3.35.1 | fixed |
| Suse | dracut | linux enterprise server 15 sp6-ltss | 059+suse.571.g3d42218af-150600.3.35.1 | fixed |
| Suse | dracut | linux enterprise server for sap applications 15 sp6 | 059+suse.571.g3d42218af-150600.3.35.1 | fixed |
| Suse | dracut | linux enterprise module for basesystem 15 sp7 | 059+suse.576.g72b98359a-150700.3.23.1 | fixed |
| Suse | dracut | linux enterprise high availability extension 15 sp7 | 059+suse.576.g72b98359a-150700.3.23.1 | fixed |
| Opensuse | dracut | leap 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | fixed |
| Opensuse | dracut | tumbleweed | 112+suse.47.gec0b378-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | dracut | source | sid | 112-1 | not yet assigned | Not reported | Not reported |
| Debian | dracut | source | forky | 112-1 | not yet assigned | Not reported | Not reported |
| Debian | dracut | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | dracut | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Ubuntu | dracut | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-config-generic | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-config-rescue | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-core | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-install | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-live | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-network | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Ubuntu | dracut-squash | deb | noble | 060+5-1ubuntu3.4 | Not reported | Not reported | Not reported |
| Suse | dracut | rpm | linux enterprise server 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | Not reported | SUSE-SU-2026:23614-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server for sap applications 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | Not reported | SUSE-SU-2026:23614-1 | Not reported |
| Ubuntu | dracut | deb | pro | 051-1ubuntu0.1~esm1 | Not reported | UBUNTU-CVE-2026-16445 | Not reported |
| Suse | dracut | rpm | linux micro 6.1 | 059+suse.649.g0274006-slfo.1.1_1.1 | Not reported | SUSE-SU-2026:23513-1 | Not reported |
| Suse | dracut | rpm | linux micro 6.2 | 059+suse.730.g73d3411aa-160000.1.1 | Not reported | SUSE-SU-2026:23466-1 | Not reported |
| Suse | dracut | rpm | linux micro 6.0 | 059+suse.615.g018c5a4-1.1 | Not reported | SUSE-SU-2026:23444-1 | Not reported |
| Suse | dracut | rpm | linux enterprise micro 5.3 | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise micro 5.4 | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high performance computing 15 sp4-espos | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high performance computing 15 sp4-ltss | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server 15 sp4-ltss | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server for sap applications 15 sp4 | 055+suse.371.g92f67c2-150400.3.55.1 | Not reported | SUSE-SU-2026:4078-1 | Not reported |
| Suse | dracut | rpm | linux enterprise micro 5.5 | 055+suse.408.g34171a9-150500.3.47.1 | Not reported | SUSE-SU-2026:4079-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high performance computing 15 sp5-espos | 055+suse.408.g34171a9-150500.3.47.1 | Not reported | SUSE-SU-2026:4079-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high performance computing 15 sp5-ltss | 055+suse.408.g34171a9-150500.3.47.1 | Not reported | SUSE-SU-2026:4079-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server 15 sp5-ltss | 055+suse.408.g34171a9-150500.3.47.1 | Not reported | SUSE-SU-2026:4079-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server for sap applications 15 sp5 | 055+suse.408.g34171a9-150500.3.47.1 | Not reported | SUSE-SU-2026:4079-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high availability extension 15 sp6 | 059+suse.571.g3d42218af-150600.3.35.1 | Not reported | SUSE-SU-2026:3997-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server 15 sp6-ltss | 059+suse.571.g3d42218af-150600.3.35.1 | Not reported | SUSE-SU-2026:3997-1 | Not reported |
| Suse | dracut | rpm | linux enterprise server for sap applications 15 sp6 | 059+suse.571.g3d42218af-150600.3.35.1 | Not reported | SUSE-SU-2026:3997-1 | Not reported |
| Suse | dracut | rpm | linux enterprise module for basesystem 15 sp7 | 059+suse.576.g72b98359a-150700.3.23.1 | Not reported | SUSE-SU-2026:3931-1 | Not reported |
| Suse | dracut | rpm | linux enterprise high availability extension 15 sp7 | 059+suse.576.g72b98359a-150700.3.23.1 | Not reported | SUSE-SU-2026:3931-1 | Not reported |
| Opensuse | dracut | rpm | leap 16.0 | 059+suse.730.g73d3411aa-160000.1.1 | Not reported | OPENSUSE-SU-2026:21749-1 | Not reported |
| Opensuse | dracut | rpm | tumbleweed | 112+suse.47.gec0b378-1.1 | Not reported | OPENSUSE-SU-2026:11657-1 | Not reported |
Notes
[trixie] dracut: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [dracut]Affected
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-config-generic]Affected
Source package: [dracut]
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-config-rescue]Affected
Source package: [dracut]
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-core]Affected
Source package: [dracut]
Details (4)
059-4· amd64 · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· arm64 · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· amd64 · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· arm64 · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-install]Affected
Source package: [dracut]
Details (2)
106-5~bpo12+1· amd64 · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· arm64 · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-live]Affected
Source package: [dracut]
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-network]Affected
Source package: [dracut]
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-squash]Affected
Source package: [dracut]
Details (4)
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
059-4· all · bookwormAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
- [dracut-test]Affected
Source package: [dracut]
Details (2)
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
106-5~bpo12+1· all · bookworm-backportsAffected
nvd · dracut · debian · bookworm; nvd · dracut · debian · 12
[Debian 13 (Trixie)]
- [dracut]Affected
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-config-generic]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-config-rescue]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-core]Affected
Source package: [dracut]
Details (2)
106-6· amd64 · trixieAffected
nvd · dracut · debian · 13
106-6· arm64 · trixieAffected
nvd · dracut · debian · 13
- [dracut-install]Affected
Source package: [dracut]
Details (2)
106-6· amd64 · trixieAffected
nvd · dracut · debian · 13
106-6· arm64 · trixieAffected
nvd · dracut · debian · 13
- [dracut-live]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-network]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-squash]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
- [dracut-test]Affected
Source package: [dracut]
Details (2)
106-6· all · trixieAffected
nvd · dracut · debian · 13
106-6· all · trixieAffected
nvd · dracut · debian · 13
[openSUSE Tumbleweed]
- [dracut]Affected
Source package: [dracut]
Details (1)
112+suse.34.g35e16b7-1.1· x86_64 · tumbleweedAffected · Fixed:
112+suse.47.gec0b378-1.1nvd · dracut · opensuse · tumbleweed
- [dracut-extra]Unknown
Source package: [dracut]
Details (1)
112+suse.34.g35e16b7-1.1· x86_64 · tumbleweedUnknown · Fixed:
112+suse.47.gec0b378-1.1Version impact unknown
nvd · dracut · opensuse · tumbleweed
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:26534]
- [https://access.redhat.com/errata/RHSA-2026:40700]
- [https://access.redhat.com/errata/RHSA-2026:61252]
- [https://access.redhat.com/errata/RHSA-2026:69118]
- [https://access.redhat.com/errata/RHSA-2026:69119]
- [https://access.redhat.com/errata/RHSA-2026:90272]
- [https://access.redhat.com/security/cve/CVE-2026-16445]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2459963]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2503147]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11657-1.json]
- [https://github.com/dracutdevs/dracut/commit/e509c638e6]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-16445]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-16445]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23444-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23466-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23513-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23614-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3931-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3997-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4078-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4079-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-16445]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11657-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21749-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-16445]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-16445.json]
- [https://ubuntu.com/security/notices/USN-8828-1]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]