Back Linuxsecurity SUSE Dracut Security Flaw for Code Execution CVE-2026-23444
Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×
## This update for dracut fixes the following issues: * CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). * CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580). Changes for dracut: * Update to version 059+suse.615.g018c5a4: * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname * fix(network-legacy): strip DHCP-supplied domain to a safe charset * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts ## Patch Instructions:
## This update for dracut fixes the following issues: * CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). * CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580). Changes for dracut: * Update to version 059+suse.615.g018c5a4: * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname * fix(network-legacy): strip DHCP-supplied domain to a safe charset * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts ## Patch Instructions:
* CVE-2026-16445 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16445 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-6893 ( SUSE ): 8.7
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-6893 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-6893 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-6893 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
An update that solves two vulnerabilities can now be installed.
*
*
Announcement ID: SUSE-SU-2026:23444-1 Release Date: 2026-09-02T09:29:03Z Rating: important
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
