initramfs is a small, temporary root filesystem that the bootloader loads into RAM alongside the kernel. It is a compressed cpio archive — one file per kernel, at /boot/initramfs-<kernel-version>.img — containing just enough to get the real system mounted: kernel modules for the storage controller and filesystem, LVM and device-mapper tools, LUKS unlock code, multipath drivers, and network setup for NFS or iSCSI roots.
the boot sequence: bootloader loads kernel + initramfs into memory → the kernel unpacks the initramfs and runs its /init → that early userspace finds and mounts the real root filesystem → the system pivots (switch_root) to the real root and hands control to systemd → the initramfs is discarded from memory.
why it panics: if a module the boot needs is missing from the initramfs — a storage driver after a hardware or hypervisor change, a multipath module, an LVM piece — the kernel cannot find or mount root, and you get the classic Kernel panic - not syncing: VFS: Unable to mount root fs. The kernel itself is fine. The bridge to the disk is broken.
initrd vs initramfs: RHEL 5 and earlier used initrd, a separate ramdisk image built with mkinitrd. RHEL 6 and later use initramfs, built with dracut. Do not mix the two: mkinitrd does not exist on RHEL 9 or 10.
how it breaks: usually not bit-rot. The common causes are an interrupted kernel update or dracut run — power loss, or /boot filling up mid-write — leaving a truncated image; a hostonly image that no longer matches the hardware after a move or controller change; disk or filesystem damage on /boot; or a rebuild aimed at the wrong kernel. All of them land in the same place: the kernel cannot mount root, and you get the panic.

dracut is the tool that assembles an initramfs. It reads the kernel modules, its configuration in /etc/dracut.conf and /etc/dracut.conf.d/*.conf, and the host’s storage layout, and writes the archive to /boot.
hostonly, by default: on RHEL, dracut builds a host-only image — only the modules this machine needs. That keeps the image small and fast, and it is also why an initramfs copied from another host, or built before a controller change, can be missing exactly the driver the new hardware needs. Hostonly means the image knows this machine. It does not know the machine you moved it to.
the three forms you need: dracut -f rebuilds the running kernel’s image (force-overwrite). dracut -f /boot/initramfs-<version>.img <version> rebuilds a named kernel’s image — the form you must use in rescue mode, where the running kernel is the rescue kernel, not yours. dracut --force --add-drivers "virtio_blk virtio_scsi" adds named drivers explicitly, for a moved VM or a changed controller.
inspect before you guess: lsinitrd /boot/initramfs-<version>.img lists what is inside an image. dracut --list-modules shows what dracut would include. Use these instead of assuming a module is present.
what dracut is not: it does not fix GRUB, reinstall the kernel, or repair a filesystem. If /boot/vmlinuz-<version> itself is missing, reinstall the kernel (dnf reinstall kernel-core-<version>) — dracut alone cannot help.

1. Name the kernel. uname -r on a running system; ls /boot/vmlinuz-* or rpm -q kernel-core in rescue mode. Every command below needs that exact version string.
2. Back up first. Always, before overwriting: cp /boot/initramfs-<version>.img /boot/initramfs-<version>.img.bak. Keep the previous kernel’s boot entry as well — it is your way back if the new image is worse.
3. Check /boot space. df -h /boot. A full /boot is a classic cause of a truncated initramfs, and rebuilding onto a full /boot just makes a second broken image.
4. Decide which path you are on. System boots and runs? Rebuild from the running system. System panics or drops to emergency mode? Rescue mode, below.

1. Back up the current image: cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.bak
2. Rebuild it, naming the kernel explicitly even here — explicit beats implicit when you are tired: dracut -f /boot/initramfs-$(uname -r).img $(uname -r) (bare dracut -f does the same for the running kernel).
3. Read the output. Warnings about missing modules are the whole point of this exercise — do not scroll past them.
4. Verify before you reboot: ls -lh /boot/initramfs-$(uname -r).img (sane size, fresh timestamp) and lsinitrd /boot/initramfs-$(uname -r).img | grep -E "virtio|nvme|mpt|megaraid|dm-|xfs|ext4" for the drivers your hardware needs.
5. Reboot and test. The running initramfs lives in memory, so rebuilding the on-disk image changes nothing until the reboot — that is expected, not a failure.

Enter rescue mode. Boot the matching RHEL 9 or 10 installation media, then choose Troubleshooting > Rescue a Red Hat Enterprise Linux system — or append inst.rescue to the boot command line (Tab on BIOS, e on UEFI). The old RHEL 6 linux rescue boot prompt is gone; do not go looking for it. Answer the language and keyboard prompts, and skip networking unless you need it.
Continue vs Skip — this is the decision that matters. Rescue offers Continue (mount the found installation under /mnt/sysimage, read-write), Read-Only, or Skip (mount nothing, you do it by hand). If Continue works, take it and skip to the chroot step. If it does not — and this is the case I kept hitting, where the volume groups never activated and /boot never mounted — choose Skip, then Start shell, and build the environment yourself. mount -a in the rescue shell does not fix this: it reads the rescue environment’s mounts, not your system’s.

1. Activate the volume groups and look: lvm vgchange -ay then lvm lvs and lsblk -f. Use the LV and device names you actually see — the OS_dg-* names below are one system’s naming, not yours.
2. Mount root and any separate filesystems: mkdir -p /mnt/sysimage then mount /dev/mapper/OS_dg-rootVol /mnt/sysimage, plus mount /dev/mapper/OS_dg-tmpVol /mnt/sysimage/tmp and mount /dev/mapper/OS_dg-varVol /mnt/sysimage/var only if those are separate filesystems on your system (check /mnt/sysimage/etc/fstab — do not mount filesystems you do not have).
3. Bind-mount the kernel filesystems — each source is different: mount --bind /dev /mnt/sysimage/dev then mount --bind /proc /mnt/sysimage/proc then mount --bind /sys /mnt/sysimage/sys. Note the correction: old notes floating around bind /dev three times. That is a copy-paste error — /proc and /sys have their own sources, and dracut needs all three.
4. Chroot: chroot /mnt/sysimage. Use the path your rescue environment reports if it differs.
5. Mount /boot and confirm it is populated: mount /boot first — inside the chroot this reads your system’s /etc/fstab and is the right first try. If that fails, mount the device lsblk showed you, e.g. mount /dev/sda1 /boot (on NVMe that looks like /dev/nvme0n1p2 — again, read it off your disk, do not copy the example). Then ls /boot: you should see vmlinuz, initramfs, and GRUB files. An empty /boot here means you are about to rebuild into the wrong place — stop.
6. Name the kernel from /boot, not from uname: ls /boot/vmlinuz-*. Inside rescue mode, uname -r reports the rescue kernel, not your installed kernel. Building for the rescue kernel’s version is the single most common way this procedure silently does nothing. You will have rebuilt a perfect initramfs for a kernel you will never boot again.
7. Back up, then rebuild that exact kernel: cp /boot/initramfs-<version>.img /boot/initramfs-<version>.img.bak then dracut -f /boot/initramfs-<version>.img <version>.
8. Verify, exit, reboot: ls -lh /boot/initramfs-<version>.img and lsinitrd /boot/initramfs-<version>.img | head, then exit out of the chroot and reboot into the rebuilt kernel.

RHEL 6 entry. Boot the matching installation media, press Tab at the boot prompt, and append linux rescue to the vmlinuz line — the procedure from Red Hat’s article, and the one my original notes were written for. Language, keyboard, and the Continue / Read-Only / Skip choice work exactly as above, and the installation mounts under /mnt/sysimage. Example kernel from that era: 2.6.32-754.49.1.el6 — the version in my own notes.
RHEL 7 entry. Boot the media and choose Troubleshooting > Rescue a Red Hat Enterprise Linux system, the same menu as RHEL 9 and 10 (or inst.rescue on the boot command line). Kernels look like 3.10.0-*.el7. From the Skip shell onward, the steps are the same as the RHEL 9/10 path.
What is identical across 6, 7, 9, and 10: lvm vgchange -ay, the bind mounts, the chroot, mounting /boot, the .bak backup, and dracut -f with an explicit output and version. RHEL 6 already uses dracut and initramfs — mkinitrd and initrd belong to RHEL 5, not 6.
What differs: the boot-entry file you check in diagnosis. RHEL 6 uses GRUB legacy, /boot/grub/grub.conf. RHEL 7 and later use GRUB 2 — check grubby --info=DEFAULT or the GRUB 2 configuration rather than hunting for a grub.conf that does not exist. And on RHEL 6, expect BIOS and /dev/sda-style names far more often; the NVMe and UEFI notes above are mostly a 9/10-era concern, but read lsblk on every version anyway.

Boot the previous kernel. If it boots, the problem is the new image, not the disk — compare the two with lsinitrd and look for the module present in the old image and missing from the new one. The classic Red Hat diagnostic is exactly this: an old initrd loading storage and multipath modules the new one dropped.
Add the missing driver explicitly: dracut --force --add-drivers "virtio_blk virtio_scsi virtio_pci" /boot/initramfs-<version>.img <version> (adjust the driver list to your controller — NVMe, mpt, megaraid, whatever lsinitrd on the working image shows).
Check the dracut configuration: a stray file in /etc/dracut.conf.d/ omitting a driver, or a hostonly image built before a hardware move, will reproduce the same broken image on every rebuild. Rebuilding the same broken image twice does not make it less broken. For a moved VM or changed controller, dracut --no-hostonly builds a generic image with the full driver set.
Check the GRUB entry: confirm the boot entry actually points at the image you just built (grubby --info=DEFAULT, or inspect /boot/loader/entries/). A fresh image that no boot entry references helps nobody.
Check /boot again: if the rebuild wrote a suspiciously small file, /boot was probably full or the build failed partway — read the dracut output instead of rebooting on hope.

Running: backup → dracut -f /boot/initramfs-$(uname -r).img $(uname -r) → verify → reboot.
Rescue: Troubleshooting → Skip → vgchange → mount root + binds → chroot → mount /boot → name kernel from /boot → backup → dracut -f with explicit version → verify → reboot.
Diagnose: previous kernel → lsinitrd compare → --add-drivers or --no-hostonly → check GRUB entry.
Versions: RHEL 6: Tab → linux rescue. RHEL 7/8/9/10: Troubleshooting → Rescue. The chroot, backup, and dracut steps are identical after entry.