UbuntuUpdates.org

Package "dracut-install"

Name: dracut-install

Description:

dracut is an event driven initramfs infrastructure (dracut-install)
Latest version: 060+5-1ubuntu3.4
Release: noble (24.04)
Level: security
Repository: main
Head package: dracut
Homepage: https://github.com/dracutdevs/dracut/wiki/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "dracut-install"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "dracut-install" in Noble

Repository Area Version
base main 060+5-1ubuntu3
updates main 060+5-1ubuntu3.4

Changelog

Version: 060+5-1ubuntu3.4 2026-09-28 02:07:22 UTC

dracut (060+5-1ubuntu3.4) noble-security; urgency=medium

  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2026-15816-1.patch: feat(base): add escape function
      implementing printf %q in modules.d/99base/dracut-lib.sh.
    - debian/patches/CVE-2026-15816-2.patch: fix(base): sanitize message written
      by die() to the emergency hook in modules.d/99base/dracut-lib.sh.
    - CVE-2026-15816
  * SECURITY UPDATE: Remote Code Execution
    - debian/patches/CVE-2026-6893-1.patch: fix(network-legacy): sanitize DHCP
      values in dhclient-script.sh in modules.d/35network-legacy/dhclient-
      script.sh.
    - debian/patches/CVE-2026-6893-2.patch: fix(network-legacy): strip DHCP-
      supplied domain to a safe charset in modules.d/35network-legacy/dhclient-
      script.sh.
    - CVE-2026-6893

 -- John Breton Thu, 24 Sep 2026 13:28:12 -0400
CVE-2026-15816 A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory wit
CVE-2026-6893 A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Hos


About   -   Send Feedback to @ubuntu_updates