USN-8758-1: dracut vulnerability
Ubuntu patches dracut CVE-2026-15816, where a rogue adjacent-network DHCP server can inject root-executed commands during boot-failure handling.
Ubuntu security notice USN-8758-1 fixes CVE-2026-15816 in dracut, where messages written by the die() function to the emergency hook directory are not properly shell-quoted. An attacker on an adjacent network controlling a rogue DHCP server could exploit this to inject commands executing as root during boot-failure handling. Users should apply the patched dracut package.
30