USN-8988-1: Relax-and-Recover vulnerability
Published Nov 3, 2026
·Updated
It was discovered that Relax-and-Recover created a world-readable initrd when GRUBRESCUE was enabled. A local attacker could possibly use this issue to obtain sensitive information.
Affected Software
9 affected componentsFixes available
All of the following
ubuntu/rear<2.6+dfsg-1+deb11u1build0.22.04.1
2.6+dfsg-1+deb11u1build0.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/rear<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=20.04
All of the following
ubuntu/rear<Ubuntu Pro
Ubuntu Pro
Ubuntu Ubuntu=18.04
ubuntu/rear<2.3+dfsg-1ubuntu0.1~esm1
2.3+dfsg-1ubuntu0.1~esm1
ubuntu/rear<2.5+dfsg-1ubuntu0.1~esm1
2.5+dfsg-1ubuntu0.1~esm1
ubuntu/rear<2.6+dfsg-1+deb11u1build0.22.04.1
2.6+dfsg-1+deb11u1build0.22.04.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rearto a version that resolves this vulnerability.Fixed in 2.6+dfsg-1+deb11u1build0.22.04.1 - Upgrade
Upgrade
ubuntu/rearto a version that resolves this vulnerability.Fixed in Ubuntu Pro - Upgrade
Upgrade
ubuntu/rearto a version that resolves this vulnerability.Fixed in 2.3+dfsg-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/rearto a version that resolves this vulnerability.Fixed in 2.5+dfsg-1ubuntu0.1~esm1
Event History
Nov 3, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Advisory Published
via OSV·05:37 PM
Data Sourced
via OSV·05:37 PM
DescriptionAffected Software