diff --git a/0111.patch b/0111.patch
new file mode 100644
index 0000000..986be06
--- /dev/null
+++ b/0111.patch
@@ -0,0 +1,65 @@
+From f64e4f1d9d8c715c45db1374f2786d6c384e94c7 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Tue, 10 Feb 2026 03:35:26 +0100
+Subject: [PATCH] feat(resume): add device used for resume
+
+regardless of whether it's mounted.
+
+(cherry picked from commit 9d63c6ad9180fde668cb7d259e8f445d1f5677ea)
+
+Resolves: RHEL-119785
+---
+ modules.d/95resume/module-setup.sh | 21 +++++++++++++++++++--
+ 1 file changed, 19 insertions(+), 2 deletions(-)
+
+diff --git a/modules.d/95resume/module-setup.sh b/modules.d/95resume/module-setup.sh
+index 4b8d8422..66383b39 100755
+--- a/modules.d/95resume/module-setup.sh
++++ b/modules.d/95resume/module-setup.sh
+@@ -19,26 +19,43 @@ check() {
+ }
+ 
+ # called by dracut
+-cmdline() {
++_get_resume_dev() {
+     local _resume
+ 
+     for dev in "${!host_fs_types[@]}"; do
+         [[ ${host_fs_types[$dev]} =~ ^(swap|swsuspend|swsupend)$ ]] || continue
+         _resume=$(shorten_persistent_dev "$(get_persistent_dev "$dev")")
+-        [[ -n ${_resume} ]] && printf " resume=%s" "${_resume}"
++        [[ -n ${_resume} ]] && echo "${_resume}"
+     done
+ }
+ 
++# called by dracut
++cmdline() {
++    local _resume
++    _resume=$(_get_resume_dev)
++    [[ -n ${_resume} ]] && printf " resume=%s" "${_resume}"
++}
++
+ # called by dracut
+ install() {
+     local _bin
+     local _resumeconf
++    local _dev
+ 
+     if [[ $hostonly_cmdline == "yes" ]]; then
+         _resumeconf=$(cmdline)
+         [[ $_resumeconf ]] && printf "%s\n" "$_resumeconf" >> "${initdir}/etc/cmdline.d/95resume.conf"
+     fi
+ 
++    # If we have a resume device on cmdline, we its drivers in initrd regardless whether it's currently mounted
++    # check current cmdline as well as fstab one
++    _dev=$(_get_resume_dev)
++    [[ $_dev ]] && push_user_devs "$_dev"
++
++    _dev=$(grep -oP "resume=\K([^ ]*)" /proc/cmdline)
++    _dev=$(shorten_persistent_dev "$(get_persistent_dev "$_dev")")
++    [[ $_dev ]] && push_user_devs "$_dev"
++
+     # if systemd is included and has the hibernate-resume tool, use it and nothing else
+     if dracut_module_included "systemd" && [[ -x $dracutsysrootdir$systemdutildir/systemd-hibernate-resume ]]; then
+         inst_multiple -o \
+
diff --git a/0112.patch b/0112.patch
new file mode 100644
index 0000000..451a6e7
--- /dev/null
+++ b/0112.patch
@@ -0,0 +1,30 @@
+From 124a6ae95b58d10047c4b866e36db16e768eb03a Mon Sep 17 00:00:00 2001
+From: Li Tian <litian@redhat.com>
+Date: Wed, 14 Jan 2026 13:24:36 +0800
+Subject: [PATCH] fix(dracut): remove trailing null characters from SBATs when
+ building UKIs
+
+SBAT of kernel has null character paddings at the end. Using tools
+like ukify will display massive amount of '\0' in SBAT. Ukify is
+doing ".rstrip('b\x00')" when merging SBATs.
+
+(cherry picked from commit cbe71b639522c3f328d2a1757a3c54214df66b31)
+
+Resolves: RHEL-140458
+---
+ dracut.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dracut.sh b/dracut.sh
+index 47adee2f..4b6410c0 100755
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -2641,6 +2641,7 @@ get_sbat_string() {
+     local inp=$1
+     local out=$uefi_outdir/$2
+     objcopy -O binary --only-section=.sbat "$inp" "$out"
++    sed -i 's/\x00*$//' "$out"
+     clean_sbat_string "$out"
+ }
+ 
+
diff --git a/0113.patch b/0113.patch
new file mode 100644
index 0000000..b84646a
--- /dev/null
+++ b/0113.patch
@@ -0,0 +1,185 @@
+From b20496bc5a74e9d7ed15ab1888bc0687741bfa64 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Thu, 23 Apr 2026 17:20:04 +0200
+Subject: [PATCH] fix(network-legacy): replace `echo` writes with `printf` to
+ prevent injection via DHCP
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+DHCP-provided variables (hostname, gateway) were written with echo into
+files later sourced as shell by net-lib.sh — allowing command injection
+from a rogue DHCP server.
+
+Use printf with explicit variable escaping `%q` for sourced files:
+  - .hostname files (DHCP hostname, sourced at net-lib.sh:131)
+  - .gw files (DHCP routers, sourced at net-lib.sh:140)
+  - do_static gateway and hostname (kernel cmdline ip= parameter)
+
+Plain text config files (.resolv.conf) are left as echo — they are
+read by awk, not sourced as shell, so %q escaping would be incorrect.
+
+Resolves: RHEL-170858
+---
+ modules.d/35network-legacy/dhclient-script.sh | 24 +++++++++++++++-------
+ modules.d/35network-legacy/ifup.sh            | 29 ++++++++++++++++++---------
+ 2 files changed, 36 insertions(+), 17 deletions(-)
+
+diff --git a/modules.d/35network-legacy/dhclient-script.sh b/modules.d/35network-legacy/dhclient-script.sh
+index 82fc7e2c..2272c4c0 100755
+--- a/modules.d/35network-legacy/dhclient-script.sh
++++ b/modules.d/35network-legacy/dhclient-script.sh
+@@ -48,22 +48,24 @@ setup_interface() {
+     if [ -n "$gw" ]; then
+         if [ "$mask" = "255.255.255.255" ]; then
+             # point-to-point connection => set explicit route to gateway
+-            echo ip route add "$gw" dev "$netif" > /tmp/net."$netif".gw
++            printf 'ip route add %q dev %q\n' "$gw" "$netif" > /tmp/net."$netif".gw
+         fi
+ 
+         echo "$gw" | {
+             IFS=' ' read -r main_gw other_gw
+-            echo ip route replace default via "$main_gw" dev "$netif" >> /tmp/net."$netif".gw
++            printf 'ip route replace default via %q dev %q\n' "$main_gw" "$netif" >> /tmp/net."$netif".gw
+             if [ -n "$other_gw" ]; then
+                 for g in $other_gw; do
+-                    echo ip route add default via "$g" dev "$netif" >> /tmp/net."$netif".gw
++                    printf 'ip route add default via %q dev %q\n' "$g" "$netif" >> /tmp/net."$netif".gw
+                 done
+             fi
+         }
+     fi
+ 
+     if getargbool 1 rd.peerdns; then
+-        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf
++        if [ -n "${search}${domain}" ]; then
++            echo "search $search $domain" > /tmp/net."$netif".resolv.conf
++        fi
+         if [ -n "$namesrv" ]; then
+             for s in $namesrv; do
+                 echo nameserver "$s"
+@@ -72,7 +74,10 @@ setup_interface() {
+     fi
+     # Note: hostname can be fqdn OR short hostname, so chop off any
+     # trailing domain name and explicity add any domain if set.
+-    [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
++    if [ -n "$hostname" ]; then
++        safe_hostname=$(printf '%s' "${hostname%."$domain"}${domain:+.$domain}")
++        printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname
++    fi
+ }
+ 
+ setup_interface6() {
+@@ -95,7 +100,9 @@ setup_interface6() {
+         ${preferred_lft:+preferred_lft ${preferred_lft}}
+ 
+     if getargbool 1 rd.peerdns; then
+-        [ -n "${search}${domain}" ] && echo "search $search $domain" > /tmp/net."$netif".resolv.conf
++        if [ -n "${search}${domain}" ]; then
++            echo "search $search $domain" > /tmp/net."$netif".resolv.conf
++        fi
+         if [ -n "$namesrv" ]; then
+             for s in $namesrv; do
+                 echo nameserver "$s"
+@@ -105,7 +112,10 @@ setup_interface6() {
+ 
+     # Note: hostname can be fqdn OR short hostname, so chop off any
+     # trailing domain name and explicity add any domain if set.
+-    [ -n "$hostname" ] && echo "echo ${hostname%.$domain}${domain:+.$domain} > /proc/sys/kernel/hostname" > /tmp/net."$netif".hostname
++    if [ -n "$hostname" ]; then
++        safe_hostname=$(printf '%s' "${hostname%."$domain"}${domain:+.$domain}")
++        printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname
++    fi
+ }
+ 
+ parse_option_121() {
+diff --git a/modules.d/35network-legacy/ifup.sh b/modules.d/35network-legacy/ifup.sh
+index 0dc9541c..84c53dc4 100755
+--- a/modules.d/35network-legacy/ifup.sh
++++ b/modules.d/35network-legacy/ifup.sh
+@@ -28,7 +28,7 @@ do_dhcp_parallel() {
+     # event for nfsroot
+     # XXX add -V vendor class and option parsing per kernel
+ 
+-    [ -e "/tmp/dhclient.$netif.pid" ] && return 0
++    [ -e "/tmp/dhclient.${netif}.pid" ] && return 0
+ 
+     if ! iface_has_carrier "$netif"; then
+         warn "No carrier detected on interface $netif"
+@@ -121,8 +121,10 @@ do_ipv6auto() {
+     wait_for_ipv6_auto "$netif"
+     ret=$?
+ 
+-    [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname"
+-
++    if [ -n "$hostname" ]; then
++        safe_hostname=$(printf '%s' "${hostname}")
++        printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname
++    fi
+     return "$ret"
+ }
+ 
+@@ -134,7 +136,10 @@ do_ipv6link() {
+     echo 0 > /proc/sys/net/ipv6/conf/"${netif}"/accept_redirects
+     linkup "$netif"
+ 
+-    [ -n "$hostname" ] && echo "echo $hostname > /proc/sys/kernel/hostname" > "/tmp/net.${netif}.hostname"
++    if [ -n "$hostname" ]; then
++        safe_hostname=$(printf '%s' "${hostname}")
++        printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname
++    fi
+ 
+     return "$ret"
+ }
+@@ -187,8 +192,12 @@ do_static() {
+         ip addr add "$ip/$mask" ${srv:+peer "$srv"} brd + dev "$netif"
+     fi
+ 
+-    [ -n "$gw" ] && echo "ip route replace default via '$gw' dev '$netif'" > "/tmp/net.$netif.gw"
+-    [ -n "$hostname" ] && echo "echo '$hostname' > /proc/sys/kernel/hostname" > "/tmp/net.$netif.hostname"
++    [ -n "$gw" ] && printf "ip route replace default via %q dev %q\n" "$gw" "$netif" > "/tmp/net.${netif}.gw"
++
++    if [ -n "$hostname" ]; then
++        safe_hostname=$(printf '%s' "${hostname}")
++        printf 'echo %q > /proc/sys/kernel/hostname\n' "$safe_hostname" > /tmp/net."$netif".hostname
++    fi
+ 
+     return 0
+ }
+@@ -417,7 +426,7 @@ fi
+ [ -n "$2" -a "$2" = "-m" ] && [ -z "$netroot" ] && manualup="$2"
+ 
+ if [ -n "$manualup" ]; then
+-    : > "/tmp/net.$netif.manualup"
++    : > "/tmp/net.${netif}.manualup"
+     rm -f "/tmp/net.${netif}.did-setup"
+ else
+     [ -e "/tmp/net.${netif}.did-setup" ] && exit 0
+@@ -458,7 +467,7 @@ for p in $(getargs ip=); do
+     # Store config for later use
+     for i in ip srv gw mask hostname macaddr mtu dns1 dns2; do
+         eval '[ "$'$i'" ] && echo '$i'="$'$i'"'
+-    done > "/tmp/net.$netif.override"
++    done > "/tmp/net.${netif}.override"
+ 
+     for autoopt in $(str_replace "$autoconf" "," " "); do
+         case $autoopt in
+@@ -492,7 +501,7 @@ for p in $(getargs ip=); do
+     # setup nameserver
+     for s in "$dns1" "$dns2" $(getargs nameserver); do
+         [ -n "$s" ] || continue
+-        echo "nameserver $s" >> "/tmp/net.$netif.resolv.conf"
++        echo "nameserver $s" >> "/tmp/net.${netif}.resolv.conf"
+     done
+ 
+     if [ $ret -eq 0 ]; then
+@@ -546,7 +555,7 @@ if [ -z "$NO_AUTO_DHCP" ] && [ ! -e "/tmp/net.${netif}.up" ]; then
+ 
+     for s in $(getargs nameserver); do
+         [ -n "$s" ] || continue
+-        echo "nameserver $s" >> "/tmp/net.$netif.resolv.conf"
++        echo "nameserver $s" >> "/tmp/net.${netif}.resolv.conf"
+     done
+ 
+     if [ "$ret" -eq 0 ] && [ -n "$(ls "/tmp/leaseinfo.${netif}"* 2> /dev/null)" ]; then
+
diff --git a/0114.patch b/0114.patch
new file mode 100644
index 0000000..e02ec9a
--- /dev/null
+++ b/0114.patch
@@ -0,0 +1,97 @@
+From a633292e4c661c6baaabf9f8d8fc818ca3e0233d Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Wed, 29 Apr 2026 04:46:15 +0200
+Subject: [PATCH] fix(iscsi): replace `echo` writes with `printf` to prevent
+ variable injection
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use printf with explicit variable escaping `%q` for shell scripts:
+  - mount-lun.sh hookdir script (iscsi_lun variable)
+  - udev rule (iscsi_lun sanitized via tr -d '"')
+  - initiatorname.iscsi (sourced as shell at iscsiroot.sh:161-163)
+
+Note: initiatorname.iscsi is also read by iscsid as plain text (no
+shell unquoting). For valid IQNs ([a-z0-9.:_-]), %q is a no-op, so
+iscsid sees the value unchanged. For malicious values with special
+characters, %q would produce shell escaping that iscsid reads
+literally — breaking the connection rather than allowing injection.
+
+Related: RHEL-170858
+---
+ modules.d/95iscsi/iscsiroot.sh       | 10 +++++-----
+ modules.d/95iscsi/parse-iscsiroot.sh |  4 ++--
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/modules.d/95iscsi/iscsiroot.sh b/modules.d/95iscsi/iscsiroot.sh
+index 63b4ce19..24d9f5bb 100755
+--- a/modules.d/95iscsi/iscsiroot.sh
++++ b/modules.d/95iscsi/iscsiroot.sh
+@@ -145,7 +145,7 @@ handle_netroot() {
+ 
+     if [ -z "$iscsi_initiator" ] && [ -f /sys/firmware/ibft/initiator/initiator-name ] && ! [ -f /tmp/iscsi_set_initiator ]; then
+         iscsi_initiator=$(while read -r line || [ -n "$line" ]; do echo "$line"; done < /sys/firmware/ibft/initiator/initiator-name)
+-        echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi
++        printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi
+         rm -f /etc/iscsi/initiatorname.iscsi
+         mkdir -p /etc/iscsi
+         ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi
+@@ -166,7 +166,7 @@ handle_netroot() {
+ 
+     if [ -z "$iscsi_initiator" ]; then
+         iscsi_initiator=$(iscsi-iname)
+-        echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi
++        printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi
+         rm -f /etc/iscsi/initiatorname.iscsi
+         mkdir -p /etc/iscsi
+         ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi
+@@ -190,7 +190,7 @@ handle_netroot() {
+         iscsi_lun=0
+     fi
+ 
+-    echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi
++    printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi
+     ln -fs /run/initiatorname.iscsi /dev/.initiatorname.iscsi
+     if ! [ -e /etc/iscsi/initiatorname.iscsi ]; then
+         mkdir -p /etc/iscsi
+@@ -211,14 +211,14 @@ handle_netroot() {
+ 
+     if [ "$root" = "dhcp" ] || [ "$netroot" = "dhcp" ]; then
+         # if root is not specified try to mount the whole iSCSI LUN
+-        printf 'SYMLINK=="disk/by-path/*-iscsi-*-%s", SYMLINK+="root"\n' "$iscsi_lun" >> /etc/udev/rules.d/99-iscsi-root.rules
++        printf 'SYMLINK=="disk/by-path/*-iscsi-*-%s", SYMLINK+="root"\n' "$(printf '%s' "$iscsi_lun" | tr -d '"')" >> /etc/udev/rules.d/99-iscsi-root.rules
+         udevadm control --reload
+         write_fs_tab /dev/root
+         wait_for_dev -n /dev/root
+ 
+         # install mount script
+         [ -z "$DRACUT_SYSTEMD" ] \
+-            && echo "iscsi_lun=$iscsi_lun . /bin/mount-lun.sh " > "$hookdir"/mount/01-$$-iscsi.sh
++            && printf 'iscsi_lun=%q . /bin/mount-lun.sh\n' "$iscsi_lun" > "$hookdir"/mount/01-$$-iscsi.sh
+     fi
+ 
+     if strglobin "$iscsi_target_ip" '*:*:*' && ! strglobin "$iscsi_target_ip" '['; then
+diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh
+index 75747111..1a102b12 100755
+--- a/modules.d/95iscsi/parse-iscsiroot.sh
++++ b/modules.d/95iscsi/parse-iscsiroot.sh
+@@ -105,7 +105,7 @@ fi
+ 
+ if arg=$(getarg rd.iscsi.initiator -d iscsi_initiator=) && [ -n "$arg" ] && ! [ -f /run/initiatorname.iscsi ]; then
+     iscsi_initiator=$arg
+-    echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi
++    printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi
+     ln -fs /run/initiatorname.iscsi /dev/.initiatorname.iscsi
+     rm -f /etc/iscsi/initiatorname.iscsi
+     mkdir -p /etc/iscsi
+@@ -121,7 +121,7 @@ fi
+ if [ -z "$iscsi_initiator" ] && [ -f /sys/firmware/ibft/initiator/initiator-name ] && ! [ -f /tmp/iscsi_set_initiator ]; then
+     iscsi_initiator=$(while read -r line || [ -n "$line" ]; do echo "$line"; done < /sys/firmware/ibft/initiator/initiator-name)
+     if [ -n "$iscsi_initiator" ]; then
+-        echo "InitiatorName=$iscsi_initiator" > /run/initiatorname.iscsi
++        printf 'InitiatorName=%q\n' "$iscsi_initiator" > /run/initiatorname.iscsi
+         rm -f /etc/iscsi/initiatorname.iscsi
+         mkdir -p /etc/iscsi
+         ln -fs /run/initiatorname.iscsi /etc/iscsi/initiatorname.iscsi
+
diff --git a/0115.patch b/0115.patch
new file mode 100644
index 0000000..1531ca5
--- /dev/null
+++ b/0115.patch
@@ -0,0 +1,46 @@
+From 8823fab4f32315e5e7c376116954b9f84b2576dd Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Tue, 12 May 2026 03:25:20 +0200
+Subject: [PATCH] fix(network): warn on suspicious shell metacharacters in
+ hostname file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+setup_net() sources /tmp/net.$netif.hostname as shell, which is written
+by dhclient-script.sh or ifup.sh. Add a defensive check that warns if
+the file contains shell metacharacters ($, `, ;, &, |, () that should
+never appear in a legitimate hostname, indicating possible DHCP-based
+command injection attempts.
+
+The file is still sourced for compatibility — the writer-side fix
+(printf '%q') already prevents execution of injected content.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+
+Related: RHEL-170858
+---
+ modules.d/40network/net-lib.sh | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/modules.d/40network/net-lib.sh b/modules.d/40network/net-lib.sh
+index a294a390..03be4c6d 100755
+--- a/modules.d/40network/net-lib.sh
++++ b/modules.d/40network/net-lib.sh
+@@ -127,8 +127,13 @@ setup_net() {
+     [ -e "/tmp/net.ifaces" ] && read -r IFACES < /tmp/net.ifaces
+     [ -z "$IFACES" ] && IFACES="$netif"
+     # run the scripts written by ifup
+-    # shellcheck disable=SC1090
+-    [ -e /tmp/net."$netif".hostname ] && . /tmp/net."$netif".hostname
++    if [ -e /tmp/net."$netif".hostname ]; then
++        if grep -qE '[$`;&|(]' /tmp/net."$netif".hostname 2> /dev/null; then
++            warn "setup_net $netif: /tmp/net.$netif.hostname contains suspicious shell metacharacters"
++        fi
++        # shellcheck disable=SC1090
++        . /tmp/net."$netif".hostname
++    fi
+     # shellcheck disable=SC1090
+     [ -e /tmp/net."$netif".override ] && . /tmp/net."$netif".override
+     # shellcheck disable=SC1090
+
diff --git a/0116.patch b/0116.patch
new file mode 100644
index 0000000..54b38fe
--- /dev/null
+++ b/0116.patch
@@ -0,0 +1,71 @@
+From 9d48f561951fbcec26387e4ca626562bc9ee9b22 Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Tue, 12 May 2026 03:27:22 +0200
+Subject: [PATCH] fix(base): escape arguments in initqueue hook script
+ generation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+initqueue.sh writes arguments directly into generated hook scripts
+via `echo "$exe" "$@"`. These scripts are later sourced by
+dracut-initqueue.sh, so shell metacharacters in arguments (e.g.
+DHCP-derived $netroot passed from parse-iscsiroot.sh) execute as
+root in initramfs.
+
+Replace `echo` with `printf '%q'` to shell-escape all arguments
+before writing them into the hook script, preventing command
+injection via DHCP-controlled netroot values.
+
+Remove the fragile embedded single-quote wrapping ("'$var'") from
+parse-iscsiroot.sh call sites (lines 90, 102) — those relied on
+echo writing quotes verbatim for the shell to strip when sourcing.
+With printf '%q', initqueue now handles escaping centrally, so the
+manual wrapping is no longer needed and would cause literal quote
+characters to leak into iscsiroot arguments.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+
+Related: RHEL-170858
+---
+ modules.d/95iscsi/parse-iscsiroot.sh | 4 ++--
+ modules.d/99base/initqueue.sh        | 3 ++-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/modules.d/95iscsi/parse-iscsiroot.sh b/modules.d/95iscsi/parse-iscsiroot.sh
+index 1a102b12..80aae95f 100755
+--- a/modules.d/95iscsi/parse-iscsiroot.sh
++++ b/modules.d/95iscsi/parse-iscsiroot.sh
+@@ -87,7 +87,7 @@ if [ -n "$iscsi_firmware" ]; then
+     echo "${DRACUT_SYSTEMD+systemctl is-active initrd-root-device.target || }[ -f '/tmp/iscsistarted-firmware' ]" > "$hookdir"/initqueue/finished/iscsi_started.sh
+     initqueue --unique --online /sbin/iscsiroot online "iscsi:" "$NEWROOT"
+     initqueue --unique --onetime --timeout /sbin/iscsiroot timeout "iscsi:" "$NEWROOT"
+-    initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "'$NEWROOT'"
++    initqueue --unique --onetime --settled /sbin/iscsiroot online "iscsi:" "$NEWROOT"
+ fi
+ 
+ # ISCSI actually supported?
+@@ -99,7 +99,7 @@ modprobe --all -b -q qla4xxx cxgb3i cxgb4i bnx2i be2iscsi
+ 
+ if [ -n "$netroot" ] && [ "$root" != "/dev/root" ] && [ "$root" != "dhcp" ]; then
+     if ! getargbool 1 rd.neednet > /dev/null || ! getarg "ip="; then
+-        initqueue --unique --onetime --settled /sbin/iscsiroot dummy "'$netroot'" "'$NEWROOT'"
++        initqueue --unique --onetime --settled /sbin/iscsiroot dummy "$netroot" "$NEWROOT"
+     fi
+ fi
+ 
+diff --git a/modules.d/99base/initqueue.sh b/modules.d/99base/initqueue.sh
+index 2c490793..672effd6 100755
+--- a/modules.d/99base/initqueue.sh
++++ b/modules.d/99base/initqueue.sh
+@@ -64,7 +64,8 @@ fi
+     # shellcheck disable=SC2016
+     [ -n "$onetime" ] && echo '[ -e "$job" ] && rm -f -- "$job"'
+     [ -n "$env" ] && echo "$env"
+-    echo "$exe" "$@"
++    printf '%q ' "$exe" "$@"
++    printf '\n'
+ } > "/tmp/$$-${job}.sh"
+ 
+ mv -f "/tmp/$$-${job}.sh" "$hookdir/initqueue${qname}/${job}.sh"
+
diff --git a/0117.patch b/0117.patch
new file mode 100644
index 0000000..70d4035
--- /dev/null
+++ b/0117.patch
@@ -0,0 +1,47 @@
+From 365b910c00331ba0c0734919e1ea8b5f8d2503ab Mon Sep 17 00:00:00 2001
+From: Pavel Valena <pvalena@redhat.com>
+Date: Wed, 24 Jun 2026 22:54:40 +0200
+Subject: [PATCH] revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless
+ excluded"
+
+This reverts commit 35e125e0b8c013e759b4a1b819d73a99adcbf347.
+
+Resolves: RHEL-178488
+---
+ modules.d/10i18n/module-setup.sh | 23 +----------------------
+ 1 file changed, 1 insertion(+), 22 deletions(-)
+
+diff --git a/modules.d/10i18n/module-setup.sh b/modules.d/10i18n/module-setup.sh
+index 11aedb0c..35bda36f 100755
+--- a/modules.d/10i18n/module-setup.sh
++++ b/modules.d/10i18n/module-setup.sh
+@@ -11,28 +11,7 @@ check() {
+ 
+ # called by dracut
+ depends() {
+-    # Include "drm" / "simpledrm" to be able to set the console font properly
+-    local _module _drm
+-    local -a _modules=(drm simpledrm)
+-
+-    for _module in "${_modules[@]}"; do
+-        if dracut_module_included "$_module"; then
+-            _drm="$_module"
+-            break
+-        fi
+-    done
+-
+-    if [[ -z $_drm ]]; then
+-        for _module in "${_modules[@]}"; do
+-            module_check "$_module" > /dev/null 2>&1
+-            if [[ $? == 255 ]] && ! [[ " $omit_dracutmodules " == *\ $_module\ * ]]; then
+-                _drm="$_module"
+-                break
+-            fi
+-        done
+-    fi
+-
+-    echo "$_drm"
++    return 0
+ }
+ 
+ # called by dracut
diff --git a/dracut.spec b/dracut.spec
index fb0524f..84b6827 100644
--- a/dracut.spec
+++ b/dracut.spec
@@ -5,7 +5,7 @@
 # strip the automatically generated dep here and instead co-own the
 # directory.
 %global __requires_exclude pkg-config
-%define dist_free_release 110.git20260130
+%define dist_free_release 118.git20260624
 
 Name: dracut
 Version: 057
@@ -135,6 +135,13 @@ Patch106: 0106.patch
 Patch107: 0107.patch
 Patch108: 0108.patch
 Patch109: 0109.patch
+Patch111: 0111.patch
+Patch112: 0112.patch
+Patch113: 0113.patch
+Patch114: 0114.patch
+Patch115: 0115.patch
+Patch116: 0116.patch
+Patch117: 0117.patch
 
 Source1: https://www.gnu.org/licenses/lgpl-2.1.txt
 
@@ -591,6 +598,15 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/
 %{_prefix}/lib/kernel/install.d/51-dracut-rescue.install
 
 %changelog
+* Thu Jun 25 2026 Pavel Valena <pvalena@redhat.com> - 057-118.git20260624
+- feat(resume): add device used for resume
+- fix(dracut): remove trailing null characters from SBATs when
+- fix(network-legacy): replace `echo` writes with `printf` to
+- fix(iscsi): replace `echo` writes with `printf` to prevent
+- fix(network): warn on suspicious shell metacharacters in
+- fix(base): escape arguments in initqueue hook script
+- revert: "feat(i18n): pull 'drm' or 'simpledrm' module unless
+
 * Fri Jan 30 2026 Pavel Valena <pvalena@redhat.com> - 057-110.git20260130
 - fix(systemd-repart): allow partition format
 - feat(install.d):according to the changes of