Back Linuxsecurity

Ubuntu 26.04 LTS dracut Critical Command Injection Vulnerability USN-8758

Linuxsecurity •LinuxSecurity Advisories • September 14, 2026

Artifactory Alert: Chained flaws let attackers gain admin control. Check your version now ×

Several security issues were fixed in dracut. Software Description: - dracut: Initramfs image generation tool Details: It was discovered that dracut did not properly shell-quote messages written by the die() function to the emergency hook directory. An attacker on the adjacent network controlling a rogue DHCP server could use this issue to inject commands that execute as root during boot-failure handling. (CVE-2026-15816)

Several security issues were fixed in dracut.

Software Description:

- dracut: Initramfs image generation tool

It was discovered that dracut did not properly shell-quote messages

written by the die() function to the emergency hook directory. An

attacker on the adjacent network controlling a rogue DHCP server could

use this issue to inject commands that execute as root during

boot-failure handling. (CVE-2026-15816)

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS dracut-core 110-11ubuntu0.1 dracut-network 110-11ubuntu0.1 After a standard system update you need to reboot your computer to make all the necessary changes.

Ubuntu Security Notice USN-8758-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical dracut Command Injection Vulnerability in Ubuntu A vulnerability (CVE-2026-15816) was discovered in dracut, an initramfs image generation tool, affecting Ubuntu 26.04 LTS. The flaw allows an attacker on an adjacent network with control over a rogue DHCP server to inject commands that execute as root during boot-failure handling. This vulnerability arises from improper shell quoting of messages written by the die() function to the emergency hook directory. Affected systems include Ubuntu 26.04 LTS with specific dracut package versions. Users are advised to update their systems to mitigate this risk. The vulnerability was published on August 7, 2026, and is considered critical due to its potential for exploitation. Immediate action is recommended to prevent unauthorized access and control. The issue can be resolved by updating to the specified package versions and rebooting the system. 4 sources 74

Extracted Entities

Ubuntu 26.04 LTS dracut Critical Command Injection Vulnerability USN-8758

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)