Skip to content
Fencer Vulns
high 7.5

CVE-2026-6893 json

Dracut: dracut: root code execution via dhcp options command injection

published 2026-06-10 4 mo ago modified 2026-11-02 6 d ago also EUVD-2026-36110

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:107-7.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:105-4.el10_0.1
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:004-413.el6_10, 0:004-414.el6_10
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:033-577.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:049-244.git20260529.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:049-138.git20220131.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:049-138.git20220131.el8_4.1
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:049-203.git20220511.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:049-203.git20220511.el8_6.1
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:049-223.git20230119.el8_8.1
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:049-223.git20230119.el8_8.1
  • Red Hat Red Hat Enterprise Linux 9 0:057-115.git20260527.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:057-25.git20250717.el9_2.2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:057-54.git20250423.el9_4.3
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:057-89.git20250311.el9_6.1
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202610250235-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202609080414-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202609011250-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202609140326-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202609011112-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202609191027-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202609031320-0, 418.94.202609171815-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202609021231-0
  • Red Hat Red Hat Hardened Images 109-6.hum1
  • dracut Debian 14 112-1

debian advisories DEBIAN-CVE-2026-6893

  • dracut Ubuntu 24.04 LTS 060+5-1ubuntu3.4
  • dracut Ubuntu Pro 16.04 LTS 044+3-3ubuntu0.1~esm1
  • dracut Ubuntu Pro 18.04 LTS 047-2ubuntu0.1~esm1
  • dracut Ubuntu Pro 20.04 LTS 048+80-2ubuntu0.1~esm1
  • dracut Ubuntu Pro 22.04 LTS 051-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-6893

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dracut hummingbird 1 109-6.hum1
  • dracut-caps hummingbird 1 109-6.hum1
  • dracut-live hummingbird 1 109-6.hum1
  • dracut-tools hummingbird 1 109-6.hum1
  • dracut-squash hummingbird 1 109-6.hum1
  • dracut-network hummingbird 1 109-6.hum1
  • dracut-config-rescue hummingbird 1 109-6.hum1
  • dracut-config-generic hummingbird 1 109-6.hum1

red hat advisories RHSA-2026:79114RHSA-2026:74499RHSA-2026:69119RHSA-2026:69118RHSA-2026:62269RHSA-2026:61252

  • dracut SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 055+suse.408.g34171a9-150500.3.47.1
  • dracut SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Micro 5.4 +3 more 055+suse.371.g92f67c2-150400.3.55.1
  • dracut SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE High Availability Extension 15 SP6 059+suse.571.g3d42218af-150600.3.35.1
  • dracut SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 059+suse.730.g73d3411aa-160000.1.1
  • dracut SLE Module for Basesystem 15 SP7, SLE High Availability Extension 15 SP7 059+suse.576.g72b98359a-150700.3.23.1
  • dracut Linux Micro 6.0 059+suse.615.g018c5a4-1.1
  • dracut Linux Micro 6.1 059+suse.649.g0274006-slfo.1.1_1.1
  • dracut SLE Module for Basesystem 15 SP7, SLE High Availability Extension 15 SP7 059+suse.570.g2b84048d7-150700.3.17.1

suse advisories SUSE-SU-2026:4079-1SUSE-SU-2026:4078-1SUSE-SU-2026:3997-1SUSE-SU-2026:23466-1SUSE-SU-2026:23614-1SUSE-SU-2026:3931-1

  • dracut openSUSE Leap 16.0 059+suse.730.g73d3411aa-160000.1.1
  • dracut openSUSE Leap 16.0 059+suse.722.gdd9d67ff5-160000.1.1
  • dracut openSUSE Tumbleweed 110+suse.35.g9834432-1.1

opensuse advisories openSUSE-SU-2026:21749-1openSUSE-SU-2026:21054-1openSUSE-SU-2026:11076-1

  • dracut AlmaLinux 10 107-7.el10_2
  • dracut-caps AlmaLinux 10 107-7.el10_2
  • dracut-live AlmaLinux 10 107-7.el10_2
  • dracut-tools AlmaLinux 10 107-7.el10_2
  • dracut-squash AlmaLinux 10 107-7.el10_2
  • dracut-network AlmaLinux 10 107-7.el10_2
  • dracut-config-rescue AlmaLinux 10 107-7.el10_2
  • dracut-config-generic AlmaLinux 10 107-7.el10_2

almalinux advisories ALSA-2026:26532ALSA-2026:26533ALSA-2026:26534

  • dracut Rocky Linux 10 107-7.el10_2
  • dracut Rocky Linux 9 057-115.git20260527.el9_8
  • dracut Rocky Linux 8 049-244.git20260529.el8_10

rocky linux advisories RLSA-2026:26532RLSA-2026:26533RLSA-2026:26534

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-6893 updated cvss 7.5

dracut: dracut: Root code execution via DHCP options command injection

  • Red Hat Enterprise Linux AppStream (v. 9) dracut-caps 057-115.git20260527.el9_8, dracut-live 057-115.git20260527.el9_8
    fixed: vendor fix RHSA-2026:26533
  • Red Hat Enterprise Linux AppStream (v. 10) dracut-caps 107-7.el10_2, dracut-live 107-7.el10_2
    fixed: vendor fix RHSA-2026:26532
  • Red Hat Enterprise Linux BaseOS (v. 8) dracut 049-244.git20260529.el8_10, dracut-caps 049-244.git20260529.el8_10, dracut-live 049-244.git20260529.el8_10, dracut-tools 049-244.git20260529.el8_10, dracut-squash 049-244.git20260529.el8_10, dracut-network 049-244.git20260529.el8_10, +2 more
    fixed: vendor fix RHSA-2026:26534
  • Red Hat Enterprise Linux BaseOS (v. 9) dracut 057-115.git20260527.el9_8, dracut-tools 057-115.git20260527.el9_8, dracut-squash 057-115.git20260527.el9_8, dracut-network 057-115.git20260527.el9_8, dracut-config-rescue 057-115.git20260527.el9_8, dracut-config-generic 057-115.git20260527.el9_8
    fixed: vendor fix RHSA-2026:26533
  • Red Hat Enterprise Linux BaseOS (v. 10) dracut 107-7.el10_2, dracut-tools 107-7.el10_2, dracut-squash 107-7.el10_2, dracut-network 107-7.el10_2, dracut-config-rescue 107-7.el10_2, dracut-config-generic 107-7.el10_2
    fixed: vendor fix RHSA-2026:26532
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) dracut 049-138.git20220131.el8_4.1, dracut-caps 049-138.git20220131.el8_4.1, dracut-live 049-138.git20220131.el8_4.1, dracut-tools 049-138.git20220131.el8_4.1, dracut-squash 049-138.git20220131.el8_4.1, dracut-network 049-138.git20220131.el8_4.1, +2 more
    fixed: vendor fix RHSA-2026:69118
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) dracut 049-203.git20220511.el8_6.1, dracut-caps 049-203.git20220511.el8_6.1, dracut-live 049-203.git20220511.el8_6.1, dracut-tools 049-203.git20220511.el8_6.1, dracut-squash 049-203.git20220511.el8_6.1, dracut-network 049-203.git20220511.el8_6.1, +2 more
    fixed: vendor fix RHSA-2026:69119
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-network 049-223.git20230119.el8_8.1
    fixed: vendor fix RHSA-2026:61252
show 20 more
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) dracut 057-25.git20250717.el9_2.2, dracut-network 057-25.git20250717.el9_2.2
    fixed: vendor fix RHSA-2026:57775
  • Red Hat Enterprise Linux BaseOS E4S (v.9.4) dracut 057-54.git20250423.el9_4.3, dracut-network 057-54.git20250423.el9_4.3
    fixed: vendor fix RHSA-2026:57785
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) dracut 105-4.el10_0.1, dracut-network 105-4.el10_0.1
    fixed: vendor fix RHSA-2026:57580
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) dracut 057-89.git20250311.el9_6.1, dracut-network 057-89.git20250311.el9_6.1
    fixed: vendor fix RHSA-2026:57772
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) dracut 049-138.git20220131.el8_4.1, dracut-caps 049-138.git20220131.el8_4.1, dracut-live 049-138.git20220131.el8_4.1, dracut-tools 049-138.git20220131.el8_4.1, dracut-squash 049-138.git20220131.el8_4.1, dracut-network 049-138.git20220131.el8_4.1, +2 more
    fixed: vendor fix RHSA-2026:69118
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) dracut 049-203.git20220511.el8_6.1, dracut-caps 049-203.git20220511.el8_6.1, dracut-live 049-203.git20220511.el8_6.1, dracut-tools 049-203.git20220511.el8_6.1, dracut-squash 049-203.git20220511.el8_6.1, dracut-network 049-203.git20220511.el8_6.1, +2 more
    fixed: vendor fix RHSA-2026:69119
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) dracut 049-223.git20230119.el8_8.1, dracut-network 049-223.git20230119.el8_8.1
    fixed: vendor fix RHSA-2026:61252
  • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) dracut 004-413.el6_10, dracut 004-414.el6_10, dracut-fips 004-413.el6_10, dracut-kernel 004-413.el6_10, dracut-network 004-413.el6_10, dracut-network 004-414.el6_10
    fixed: vendor fix RHSA-2026:74499
  • Red Hat Enterprise Linux Server (v. 7 ELS) dracut 033-577.el7_9, dracut-network 033-577.el7_9
    fixed: vendor fix RHSA-2026:62269
  • Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) dracut-caps 004-413.el6_10, dracut-tools 004-413.el6_10, dracut-generic 004-413.el6_10, dracut-fips-aesni 004-413.el6_10
    fixed: vendor fix RHSA-2026:74499
  • Red Hat Hardened Images dracut 109-6.hum1, dracut-caps 109-6.hum1, dracut-live 109-6.hum1, dracut-tools 109-6.hum1, dracut-squash 109-6.hum1, dracut-network 109-6.hum1, +2 more
    fixed: vendor fix RHSA-2026:26713
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202610250235
    fixed: vendor fix RHSA-2026:90272
  • Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202609080414
    fixed: vendor fix RHSA-2026:65839
  • Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202609011250
    fixed: vendor fix RHSA-2026:62409
  • Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202609140326
    fixed: vendor fix RHSA-2026:67857
  • Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202609011112
    fixed: vendor fix RHSA-2026:62549
  • Red Hat OpenShift Container Platform 4.17 rhcos 417.94.202609191027
    fixed: vendor fix RHSA-2026:70586
  • Red Hat OpenShift Container Platform 4.18 rhcos 418.94.202609031320, rhcos 418.94.202609171815
    fixed: vendor fix RHSA-2026:65851
  • Red Hat OpenShift Container Platform 4.19 rhcos 4.19.9.6.202609021231
    fixed: vendor fix RHSA-2026:63044
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) dracut-caps 057-25.git20250717.el9_2.2, dracut-live 057-25.git20250717.el9_2.2 Red Hat Enterprise Linux AppStream E4S (v.9.4) dracut-caps 057-54.git20250423.el9_4.3, dracut-live 057-54.git20250423.el9_4.3 Red Hat Enterprise Linux AppStream EUS (v. 10.0) dracut-caps 105-4.el10_0.1, dracut-live 105-4.el10_0.1 Red Hat Enterprise Linux AppStream EUS (v.9.6) dracut-caps 057-89.git20250311.el9_6.1, dracut-live 057-89.git20250311.el9_6.1 Red Hat Enterprise Linux BaseOS E4S (v.8.8) dracut-caps 049-223.git20230119.el8_8.1, dracut-live 049-223.git20230119.el8_8.1, dracut-tools 049-223.git20230119.el8_8.1, dracut-squash 049-223.git20230119.el8_8.1, dracut-config-rescue 049-223.git20230119.el8_8.1, dracut-config-generic 049-223.git20230119.el8_8.1 Red Hat Enterprise Linux BaseOS E4S (v.9.2) dracut-tools 057-25.git20250717.el9_2.2, dracut-squash 057-25.git20250717.el9_2.2, dracut-config-rescue 057-25.git20250717.el9_2.2, dracut-config-generic 057-25.git20250717.el9_2.2
    +7 more products
    Red Hat Enterprise Linux BaseOS E4S (v.9.4) dracut 057-54.git20250423.el9_4.3, dracut-tools 057-54.git20250423.el9_4.3, dracut-squash 057-54.git20250423.el9_4.3, dracut-config-rescue 057-54.git20250423.el9_4.3, dracut-config-generic 057-54.git20250423.el9_4.3 Red Hat Enterprise Linux BaseOS EUS (v. 10.0) dracut-tools 105-4.el10_0.1, dracut-squash 105-4.el10_0.1, dracut-config-rescue 105-4.el10_0.1, dracut-config-generic 105-4.el10_0.1 Red Hat Enterprise Linux BaseOS EUS (v.9.6) dracut 057-89.git20250311.el9_6.1, dracut-tools 057-89.git20250311.el9_6.1, dracut-squash 057-89.git20250311.el9_6.1, dracut-config-rescue 057-89.git20250311.el9_6.1, dracut-config-generic 057-89.git20250311.el9_6.1 Red Hat Enterprise Linux BaseOS TUS (v.8.8) dracut-caps 049-223.git20230119.el8_8.1, dracut-live 049-223.git20230119.el8_8.1, dracut-tools 049-223.git20230119.el8_8.1, dracut-squash 049-223.git20230119.el8_8.1, dracut-config-rescue 049-223.git20230119.el8_8.1, dracut-config-generic 049-223.git20230119.el8_8.1 Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) dracut-fips 004-414.el6_10, dracut-kernel 004-414.el6_10 Red Hat Enterprise Linux Server (v. 7 ELS) dracut-fips 033-577.el7_9, dracut-fips-aesni 033-577.el7_9, dracut-config-rescue 033-577.el7_9, dracut-config-generic 033-577.el7_9 Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) dracut-caps 004-414.el6_10, dracut-tools 004-414.el6_10, dracut-generic 004-414.el6_10, dracut-fips-aesni 004-414.el6_10
    not affected: vulnerable code not present

1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

1.27% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.