Hi,

The following vulnerability was published for dracut.

CVE-2026-6893[0]:
| A flaw was found in dracut. A remote attacker on the adjacent
| network can exploit this vulnerability by providing specially
| crafted DHCP (Dynamic Host Configuration Protocol) options, such as
| a malicious hostname, to a system using dracut's legacy DHCP path.
| These options are improperly handled and written into temporary
| shell scripts without proper escaping, leading to command injection.
| This allows the attacker to achieve root code execution within the
| initramfs, potentially compromising the system's boot and network
| behavior.

Only main reference is the bugzilla entry from Red Hat[1] but there is
a draft merge request upsream now at time of writing[2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-6893
https://www.cve.org/CVERecord?id=CVE-2026-6893
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2459963
[2] https://github.com/dracut-ng/dracut/pull/2469

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
dracut, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139725@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Benjamin Drung <bdrung@debian.org> (supplier of updated dracut package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 03 Aug 2026 02:06:07 +0200
Source: dracut
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 112-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Kernel Team <debian-kernel@lists.debian.org>
Changed-By: Benjamin Drung <bdrung@debian.org>
Closes: 1132794 1139725
Launchpad-Bugs-Fixed: 2158694
Changes:
 dracut (112-1) unstable; urgency=medium
 .
   * New upstream release:
     - security fixes (CVE-2026-6893 and CVE-2026-16445, closes: #1139725):
       + network-legacy: sanitize DHCP values in dhclient-script.sh
       + overlayfs-crypt: prevent eval injection in parse_overlay_opts()
       + dracut-lib: sanitize variable assignments using eval
       + systemd-networkd: escape values from DHCP options
       + iscsi: normalize initiator and target names
       + net-lib: validate iSCSI LUN parameters
     - dracut: default to hostonly_cmdline=no in chroot (Closes: #1132794)
     - resume: include in hostonly sloppy mode if supported by kernel
       (LP: #2158694)
   * Drop patches applied upstream
   * dracut-core: add new qcom-adsp module
   * dracut-network: add new chrony module
   * Add upstream signing key
Checksums-Sha1:
 c1b69733d7c01e43611de5a8a0b26c32ffebdbbf 3265 dracut_112-1.dsc
 6f5b58b07aec0078ae2de8bb07b28d187c30a0d6 601803 dracut_112.orig.tar.gz
 0ba8f5abd0e31b58830277efa2b25e303d28380e 228 dracut_112.orig.tar.gz.asc
 b94d40ccb8a393d85856d1b4a0b44b2d2c3f8525 28588 dracut_112-1.debian.tar.xz
 123b521bb973f71dac2d418cb65f2c94e2dad096 9045 dracut_112-1_source.buildinfo
Checksums-Sha256:
 ec82e385b6bdeab6a25061fd5aeb7719a1ba4d13daecb5b8de087f994bff0e54 3265 dracut_112-1.dsc
 839d21eb4bd27bb0ee40d74c9da46df088c2e1425fcd8c3ea62b7e3a3dd28a91 601803 dracut_112.orig.tar.gz
 9b4d0d57410c6fb75bd8eae063a76ab302f5fa6839fabb27223f85fe68a44f12 228 dracut_112.orig.tar.gz.asc
 a04549c64e365851c08c09cefe700d1bd6fa5ba9412afc702696f023d0665332 28588 dracut_112-1.debian.tar.xz
 3b537d568e497f964aa1f94231528f453adec779f7795a84eb37f3745cba3c21 9045 dracut_112-1_source.buildinfo
Files:
 79373d8d295ecfa1d2e65e8e3a7ba1c1 3265 utils optional dracut_112-1.dsc
 543c07f4f9f1bd04e77835b119d3193f 601803 utils optional dracut_112.orig.tar.gz
 19b1b1d069eee34ea49996be5adb7257 228 utils optional dracut_112.orig.tar.gz.asc
 d805677ef2e215688e491a216c6d3e76 28588 utils optional dracut_112-1.debian.tar.xz
 9bd52ac5fa5aed40426a493ba6e42d7a 9045 utils optional dracut_112-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpi0s+9ULm1vzYNVLFZ61xO/Id0wFAmpv2+EACgkQFZ61xO/I
d0wPKhAAh7S2VDH3UTPa+KuY0qvE+dFx78rotiK8qRPMR0DsYWk8xRzZ2hK1GJ7t
tdVU8ZASYcQsKwLpxgF9nFvTXhYKFQYp4a3+y6GlA4dKik+3bCXm2WMMJz1tvw0X
gevfKEyVNz3//20LhmppDmN5G9tDOmAMkWOX5YwueyP+VV1s4406f6RRclpXo6sm
OE6vc7nFAn1hdlJRPB6Mus7nIOIa4g3p+6fvfa5f64o1ywjgCZeLKYVAtAe3b7ws
1GF5NbDov6TQ9ftUL+H+4IdwB8416auZCKrC9BpDrsJFYHktF9YvKsH8qwXKCpQi
F2UY68UARCZwi6CBpHnsXNPPs0muglqhgvsYFURvoXVuhVKfp017ErMy5BadHEWv
WVrH4tcrNdgN7x/Zr4QJqQJNxN1ayjlnN22148hVMVnFNN0f0Rdn3g1x9LuAHiKH
YBBfXSGxHIovTFwlhLW9J3hUc8FPTF8F3Di0Q0eqwWVgp/Wrtc+Jqq9RPxEdf+x3
dBgDkCJH6HSy0Nd4tma2TctlehzCpwADJs1eURfjundVfefZHyAtwk0VDnU1zJZL
PLjQMMrh/4wH1p+dBoQnlX6nLq1W/dXdnkBjec4oQwLz949/Xv8oKnMK2IsxifO2
df4TwF2Y/KwQrbZOWxAgVMKjgspETW+H7376HmVNKtot/b2p9qg=
=lWiH
-----END PGP SIGNATURE-----