A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

The version of dracut installed on the remote host is prior to 033-535. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3812 advisory.

    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior. (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26532 advisory.

    [107-8.0.1]
    - Suppress stderr for btrfs subvolume check [Orabug: 39059254]
    - fips: add logic for /boot subvolume on BTRFS [Orabug: 36028061]
    - Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]
    - Include correct modprobe into squashfs root [Orabug: 38559936]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [107-8]
    - revert: 'feat(i18n): pull 'drm' or 'simpledrm' module unless excluded'

    [107-7]
    - build: rebuild without an obsoleted patch

    [107-6]
    - fix(base): escape arguments in initqueue hook script generation
    - fix(net-lib): warn on suspicious shell metacharacters in hostname file
    - fix(systemd-networkd): escape DHCP lease values in dhcpopts generation       Related: RHEL-170844

    [107-5]
    - fix(network-legacy): remove network-legacy completely from the codebase
    - fix(iscsi): replace echo writes with printf to prevent variable injection       Resolves: RHEL-170844

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1965 advisory.

    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior. (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2851-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 059+suse.570.g2b84048d7:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2803-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 059+suse.565.g682306ec5:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2721-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 055+suse.402.g2720eea:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2720-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 055+suse.365.g79144c5:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0582 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-6893:
    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0169 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-6893:
    A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26533 advisory.

    [057-115.git20260527.0.1]
    - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the     kernel. [Orabug: 38705580]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [057-115.git20260527]
    - build: rebuild without an obsoleted patch

    [057-115.git20260514]
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script       Related: RHEL-170857

    [057-113.git20260502]
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(base): replace eval with safe variable indirection in       Resolves: RHEL-170857

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26534 advisory.

    [049-244.git20260529.0.1]
    - Refactor get_ucode_file [Orabug: 36989953]
    - Revert the fixes for bugs 33676753 and 33888951 due to regressions [Orabug: 35656614]
    - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch [Orabug: 35268918]
    - Enable the code to create ifcfg file [Orabug: 33888951]
    - Skip parse iscsiroot.sh on PV VMs [Orabug: 33676753]
    - Add blk_mq_alloc_disk and blk_cleanup_disk to blockfuncs [Orabug: 33603682]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Restore 51-dracut-rescue-postinst.sh for anaconda compatibility
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Add manpage for single-dhcp [Orabug 32201686]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - Use pgrep in dhcp-multi.sh to make efficient and error free [Orabug 32254008]
    - Send DHCP request in parallel on all interfaces for 80% boot time improvement [Orabug: 32034110]
    - Revert fix for [Orabug: 31404167]
    - drop 51-dracut-rescue.install patch
    - Send DHCP query only on min BDF device to improve boot times by 50-60 secs [Orabug: 31404167]
    - add ofb and cts to 01fips kernel module list [Orabug: 30622737]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Fix kernel-core POSTTRANS script issues with kernel command line [Orabug: 29542203]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Fix BOOTPROTO calculation for iscsi [Orabug: 29518713]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [049-244.git20260529]
    - fix(network-manager): escape DHCP lease values in dhcpopts
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26534 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-806:01 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26533 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26532 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26533 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26534 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26532 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26534 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26532 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26533 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior. (CVE-2026-6893)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
328826	Amazon Linux 2 : dracut, --advisory ALAS2-2026-3812 (ALAS-2026-3812)	Nessus	Amazon Linux Local Security Checks	high
328810	Oracle Linux 10 : dracut (ELSA-2026-26532)	Nessus	Oracle Linux Local Security Checks	high
328481	Amazon Linux 2023 : dracut, dracut-caps, dracut-config-generic (ALAS2023-2026-1965)	Nessus	Amazon Linux Local Security Checks	high
326428	SUSE SLED15 / SLES15 Security Update : dracut (SUSE-SU-2026:2851-1)	Nessus	SuSE Local Security Checks	high
326006	SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2803-1)	Nessus	SuSE Local Security Checks	high
324870	SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2721-1)	Nessus	SuSE Local Security Checks	high
324844	SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2720-1)	Nessus	SuSE Local Security Checks	high
324643	TencentOS Server 3: dracut (TSSA-2026:0582)	Nessus	Tencent Local Security Checks	high
324101	Alibaba Cloud Linux 3 : 0169: dracut (ALINUX3-SA-2026:0169)	Nessus	Alibaba Cloud Linux Local Security Checks	high
322994	Oracle Linux 9 : dracut (ELSA-2026-26533)	Nessus	Oracle Linux Local Security Checks	high
321808	Oracle Linux 8 : dracut (ELSA-2026-26534)	Nessus	Oracle Linux Local Security Checks	high
321701	AlmaLinux 8 : dracut (ALSA-2026:26534)	Nessus	Alma Linux Local Security Checks	high
321699	MiracleLinux 8 : dracut-049-244.git20260529.el8_10 (AXSA:2026-806:01)	Nessus	Miracle Linux Local Security Checks	high
321682	AlmaLinux 9 : dracut (ALSA-2026:26533)	Nessus	Alma Linux Local Security Checks	high
321668	RockyLinux 10 : dracut (RLSA-2026:26532)	Nessus	Rocky Linux Local Security Checks	high
321627	RockyLinux 9 : dracut (RLSA-2026:26533)	Nessus	Rocky Linux Local Security Checks	high
321625	RockyLinux 8 : dracut (RLSA-2026:26534)	Nessus	Rocky Linux Local Security Checks	high
321567	RHEL 10 : dracut (RHSA-2026:26532)	Nessus	Red Hat Local Security Checks	high
321562	RHEL 8 : dracut (RHSA-2026:26534)	Nessus	Red Hat Local Security Checks	high
321502	AlmaLinux 10 : dracut (ALSA-2026:26532)	Nessus	Alma Linux Local Security Checks	high
321353	RHEL 9 : dracut (RHSA-2026:26533)	Nessus	Red Hat Local Security Checks	high
320498	Linux Distros Unpatched Vulnerability : CVE-2026-6893	Nessus	Misc.	high

Detections

Analytics

CVE-2026-6893

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high