CVE-2026-6893 Dracut: dracut: root code execution via dhcp options command injection
Remote attackers can execute arbitrary root commands via malicious DHCP options in dracut, compromising system boot integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6893?
CVE-2026-6893 is a high-severity command injection vulnerability in Red Hat Enterprise Linux 10, published on 10 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Weakness: CWE-78
Which versions are affected by CVE-2026-6893?
Linux distribution packages (40)
dracut AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-caps AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-config-generic AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-config-rescue AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-live AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-network AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-squash AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut-tools AlmaLinux:10 | All versions | 107-7.el10_2 |
dracut AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-caps AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-config-generic AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-config-rescue AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-live AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-network AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-squash AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut-tools AlmaLinux:8 | All versions | 049-244.git20260529.el8_10 |
dracut AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-caps AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-config-generic AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-config-rescue AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-live AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-network AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-squash AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut-tools AlmaLinux:9 | All versions | 057-115.git20260527.el9_8 |
dracut Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-caps Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-config-generic Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-config-rescue Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-live Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-network Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-squash Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-tools Red Hat:enterprise_linux:10.2 | All versions | 0:107-7.el10_2 |
dracut-caps Red Hat:enterprise_linux:9::appstream | All versions | 0:057-115.git20260527.el9_8 |
dracut-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:057-115.git20260527.el9_8 |
dracut-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:057-115.git20260527.el9_8 |
dracut-live Red Hat:enterprise_linux:9::appstream | All versions | 0:057-115.git20260527.el9_8 |
dracut Red Hat:enterprise_linux:9::baseos | All versions | 0:057-115.git20260527.el9_8 |
dracut-config-generic Red Hat:enterprise_linux:9::baseos | All versions | 0:057-115.git20260527.el9_8 |
How do I fix CVE-2026-6893?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-6893 being exploited?
There is no known exploitation of CVE-2026-6893 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:26532, ALSA-2026:26533, ALSA-2026:26534, AZL-90111, BELL-CVE-2026-6893, CLSA-2026-1782829348 and 22 more.