Ubuntu alert USN-8828-1 (dracut)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8828-1] dracut vulnerabilities
Date:
             
 
Tue, 29 Sep 2026 16:07:33 +0000
Message-ID:
             
 
<E1xBaMf-0004s1-To@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8828-1
September 28, 2026

dracut vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in dracut.

Software Description:
- dracut: Initramfs generator using udev

Details:

It was discovered that dracut created initramfs images with overly
permissive permissions under certain circumstances. A local attacker could
possibly use this issue to obtain sensitive information. This issue only
affected Ubuntu 16.04 LTS. (CVE-2016-8637)

It was discovered that dracut did not properly sanitize DHCP options
before writing them to shell scripts under certain circumstances. A remote
attacker controlling a DHCP server on the local network could possibly use
this issue to execute arbitrary code as root during system boot. This issue
only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2026-6893)

It was discovered that dracut did not properly quote error messages written
to shell scripts under certain circumstances. A remote attacker controlling
a DHCP server on the local network could possibly use this issue to execute
arbitrary code as root during system boot. This issue only affected Ubuntu
16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu
24.04 LTS. (CVE-2026-15816)

It was discovered that dracut did not properly sanitize network
configuration data before writing it to a temporary shell script under
certain circumstances. A remote attacker controlling DHCP on the local
network could possibly use this issue to execute arbitrary code as root
during system boot. This issue only affected Ubuntu 22.04 LTS.
(CVE-2026-16445)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  dracut                          110-11ubuntu0.1
  dracut-core                     110-11ubuntu0.1
  dracut-network                  110-11ubuntu0.1

Ubuntu 24.04 LTS
  dracut                          060+5-1ubuntu3.4
  dracut-core                     060+5-1ubuntu3.4
  dracut-network                  060+5-1ubuntu3.4

Ubuntu 22.04 LTS
  dracut                          051-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-core                     051-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-network                  051-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  dracut                          048+80-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-core                     048+80-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-network                  048+80-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  dracut                          047-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-core                     047-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-network                  047-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  dracut                          044+3-3ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-core                     044+3-3ubuntu0.1~esm1
                                  Available with Ubuntu Pro
  dracut-network                  044+3-3ubuntu0.1~esm1
                                  Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8828-1
  CVE-2016-8637, CVE-2026-15816, CVE-2026-16445, CVE-2026-6893

Package Information:
  https://launchpad.net/ubuntu/+source/dracut/110-11ubuntu0.1
  https://launchpad.net/ubuntu/+source/dracut/060+5-1ubuntu3.4


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq6hFsACgkQcpJm3tlz
hgGVBhAAxpF0NyS0CtpF9X52X0itknngxHj7iPz+9/QTlaumLeLPJCa3PAUwbjcL
qSwkxnW/B4Ad3dy2dkKKGCR/T9nS4EqsiWcIHfuhanhsOGF5qHCYLrpFe2k3hUhp
IGX/NbrMTrkoSLu0p7HtaYVHCG4DhMvHVzKNyXrQrmCadFXxIIVck7IZ6bPBr7Hf
NTRCJvUz9MM3D7MOqWRsOmC1bwpCDBUX3mu5798uF5YSlfZ0N0/ozFl4dQ7GOWnh
KKHoBHfCGZoXmb0YHWl4VBko5MCMDAsvqO/afCc9PMtyfOCNZzcvjJi1lKvz5Kww
BAP3k8q1NnnRdDW1NTWtEKJHZfOCi29xLro77m2hHUd90V4RXLd8q5CqhEavZp+f
iGzqoWHGrn3ZvybeLmvyuh9Sl+GhKi3hh4G/eb8GiQ1kePV0Y54pPs1HbuYf5sx5
pjKwhFdyCDW1MpJoqws0B/imkd6Ww6kSEcY6Dw+hl/td/9qKSLGiE6MSkhqxrc/M
mNXdlFjj6dlzSul5J3+7QwUV76bFAu+dkT250P+TIkTAHCQSkFPJC1RXV+wwMOvK
/yLfpWZv6gymFlkMRZ2P9XToHxqiiSBQkpsMfCXMirhQCXd0knnmyvfeUJXafQmb
POhq8M+RrCanrHCIxcbZ5UEwZfQPIzhY4vHejRVg+ARRAV6YyNg=
=U0b3
-----END PGP SIGNATURE-----