Critical dracut Command Injection Vulnerability in Ubuntu

• •CVE-2026-15816 allows command injection as root during boot failures.
• •Affected systems include Ubuntu 26.04 LTS with specific dracut versions.
• •Immediate updates are required to mitigate this critical vulnerability.

A vulnerability (CVE-2026-15816) was discovered in dracut, an initramfs image generation tool, affecting Ubuntu 26.04 LTS. The flaw allows an attacker on an adjacent network with control over a rogue DHCP server to inject commands that execute as root during boot-failure handling. This vulnerability arises from improper shell quoting of messages written by the die() function to the emergency hook directory. Affected systems include Ubuntu 26.04 LTS with specific dracut package versions. Users are advised to update their systems to mitigate this risk. The vulnerability was published on August 7, 2026, and is considered critical due to its potential for exploitation. Immediate action is recommended to prevent unauthorized access and control. The issue can be resolved by updating to the specified package versions and rebooting the system.