Skip to content
SUSE Dracut Security Flaw for Code Execution CVE-2026-23444

SUSE Dracut Security Flaw for Code Execution CVE-2026-23444

Linuxsecurity LinuxSecurity Advisories September 4, 2026

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

## This update for dracut fixes the following issues: * CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). * CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580). Changes for dracut: * Update to version 059+suse.615.g018c5a4: * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname * fix(network-legacy): strip DHCP-supplied domain to a safe charset * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts ## Patch Instructions:

## This update for dracut fixes the following issues: * CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). * CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module (bsc#1273580). Changes for dracut: * Update to version 059+suse.615.g018c5a4: * fix(network-legacy): sanitize values written to /tmp/net.${netif}.override * fix(network-legacy): sanitize values written to /tmp/net.${netif}.gw * fix(network-legacy): sanitize values written to /tmp/net.${netif}.hostname * fix(network-legacy): strip DHCP-supplied domain to a safe charset * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts ## Patch Instructions:

* CVE-2026-16445 ( SUSE ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-16445 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-6893 ( SUSE ): 8.7

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2026-6893 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-6893 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-6893 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* SUSE Linux Micro 6.0

An update that solves two vulnerabilities can now be installed.

*

*

Announcement ID: SUSE-SU-2026:23444-1 Release Date: 2026-09-02T09:29:03Z Rating: important

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases