Ubuntu fixes rear: initrd readable by anyone with GRUB_RESCUE enabled

Canonical published security notice USN-8988-1 on 3 November 2026, fixing a vulnerability in the rear package (Relax-and-Recover), the open-source tool used for bare-metal disaster recovery and Linux system migration. Anyone using it to prepare recovery images on Ubuntu servers should update immediately.

The issue

According to the official advisory, Relax-and-Recover was found to create a world-readable initrd when GRUB_RESCUE was enabled, and a local attacker could potentially exploit this vulnerability to obtain sensitive information.

The flaw is identified as CVE-2024-23301. This is not a recent discovery: it has been public since January 2024, when it was reported that Relax-and-Recover (ReaR) up to version 2.7 creates a world-readable initrd when using GRUB_RESCUE=y, allowing local attackers to access system secrets otherwise restricted to root. Red Hat and SUSE had already released patches during 2024, and Debian had also intervened with an update for bookworm.

Who is affected and how to update

The Ubuntu advisory covers three releases:

Release	Package	Corrected version	Notes
22.04 LTS (jammy)	rear	2.6+dfsg-1+deb11u1build0.22.04.1	Standard repository
20.04 LTS (focal)	rear	2.5+dfsg-1ubuntu0.1~esm1	Ubuntu Pro only via ESM Apps
18.04 LTS (bionic)	rear	2.3+dfsg-1ubuntu0.1~esm1	Ubuntu Pro only via ESM Apps

For 22.04, a standard apt update && apt upgrade is sufficient. For 20.04 and 18.04, however, Relax-and-Recover creating a world-readable initrd when GRUB_RESCUE was enabled remains an open risk without an Ubuntu Pro subscription: the patch, according to the advisory, does not yet have a public community equivalent for these two releases.

Users who have configured GRUB_RESCUE on servers with sensitive data on these versions should verify the permissions of the generated initrd and plan for an upgrade or activation of ESM Apps.