A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

tencent_linux TSSA-2026:0582: TSSA-2026:0582: dracut security update (Important)

alibaba_cloud_linux ALINUX3-SA-2026:0169: ALINUX3-SA-2026:0169: dracut  security update (Important)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26533 advisory.

    [057-115.git20260527.0.1]
    - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the     kernel. [Orabug: 38705580]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [057-115.git20260527]
    - build: rebuild without an obsoleted patch

    [057-115.git20260514]
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script       Related: RHEL-170857

    [057-113.git20260502]
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(base): replace eval with safe variable indirection in       Resolves: RHEL-170857

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26534 advisory.

    [049-244.git20260529.0.1]
    - Refactor get_ucode_file [Orabug: 36989953]
    - Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614]
    - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918]
    - Enable the code to create ifcfg file [Orabug: 33888951]
    - Skip parse iscsiroot.sh on PV VMs [Orabug: 33676753]
    - Add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs [Orabug: 33603682]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Restore 51-dracut-rescue-postinst.sh for anaconda compatibility
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Add manpage for single-dhcp [Orabug 32201686]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - Use pgrep in dhcp-multi.sh to make efficient and error free [Orabug 32254008]
    - Send DHCP request in parallel on all interfaces for 80% boot time improvement [Orabug: 32034110]
    - Revert fix for [Orabug: 31404167]
    - drop 51-dracut-rescue.install patch
    - Send DHCP query only on min BDF device to improve boot times by 50-60 secs [Orabug: 31404167]
    - add ofb and cts to 01fips kernel module list [Orabug: 30622737]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Fix kernel-core POSTTRANS script issues with kernel command line [Orabug: 29542203]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Fix BOOTPROTO calculation for iscsi [Orabug: 29518713]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [049-244.git20260529]
    - fix(network-manager): escape DHCP lease values in dhcpopts
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26534 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-806:01 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26533 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26532 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26533 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26534 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26532 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26534 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26532 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26533 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior. (CVE-2026-6893)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322994	Oracle Linux 9 : dracut (ELSA-2026-26533)	Nessus	Oracle Linux Local Security Checks	high
321808	Oracle Linux 8 : dracut (ELSA-2026-26534)	Nessus	Oracle Linux Local Security Checks	high
321701	AlmaLinux 8 : dracut (ALSA-2026:26534)	Nessus	Alma Linux Local Security Checks	high
321699	MiracleLinux 8 : dracut-049-244.git20260529.el8_10 (AXSA:2026-806:01)	Nessus	Miracle Linux Local Security Checks	high
321682	AlmaLinux 9 : dracut (ALSA-2026:26533)	Nessus	Alma Linux Local Security Checks	high
321668	RockyLinux 10 : dracut (RLSA-2026:26532)	Nessus	Rocky Linux Local Security Checks	high
321627	RockyLinux 9 : dracut (RLSA-2026:26533)	Nessus	Rocky Linux Local Security Checks	high
321625	RockyLinux 8 : dracut (RLSA-2026:26534)	Nessus	Rocky Linux Local Security Checks	high
321567	RHEL 10 : dracut (RHSA-2026:26532)	Nessus	Red Hat Local Security Checks	high
321562	RHEL 8 : dracut (RHSA-2026:26534)	Nessus	Red Hat Local Security Checks	high
321502	AlmaLinux 10 : dracut (ALSA-2026:26532)	Nessus	Alma Linux Local Security Checks	high
321353	RHEL 9 : dracut (RHSA-2026:26533)	Nessus	Red Hat Local Security Checks	high
320498	Linux Distros Unpatched Vulnerability : CVE-2026-6893	Nessus	Misc.	high

Detections

Analytics

CVE-2026-6893

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high