SUSE-SU-2026:3931-1 Security update for dracut

This update for dracut fixes the following issues: - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. - CVE-2026-16445: Root code execution via DHCP options command injection in NetworkManager initrd module bsc1273580. Changes for dracut: - Update to version...

CVE-2026-16445

CVE-2026-16445 affects dracut’s NetworkManager-based initrd network module. A remote attacker on the adjacent network can craft DHCP options (root-path/next-server/bootfile) that are written into a temporary shell script without proper escaping, enabling command injection and root code execution ...