Detections
Analytics

Oracle Linux 10 : dracut (ELSA-2026-26532)

high Nessus Plugin ID 328810

Synopsis

The remote Oracle Linux host is missing a security update.

Description

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26532 advisory.

 [107-8.0.1]
 - Suppress stderr for btrfs subvolume check [Orabug: 39059254]
 - fips: add logic for /boot subvolume on BTRFS [Orabug: 36028061]
 - Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]
 - Include correct modprobe into squashfs root [Orabug: 38559936]
 - Ship Oracle IMA certificate [Orabug: 35992862]
 - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
 - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
 - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
 - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
 - Install missing 68-del-part-node.rules [Orabug: 32827579]
 - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
 - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
 - Update list of necessary files after squashfs execution [Orabug: 29864620]
 - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
 - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
 - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
 - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
 - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828] ([email protected])
 - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

 [107-8]
 - revert: 'feat(i18n): pull 'drm' or 'simpledrm' module unless excluded'

 [107-7]
 - build: rebuild without an obsoleted patch

 [107-6]
 - fix(base): escape arguments in initqueue hook script generation
 - fix(net-lib): warn on suspicious shell metacharacters in hostname file
 - fix(systemd-networkd): escape DHCP lease values in dhcpopts generation Related: RHEL-170844

 [107-5]
 - fix(network-legacy): remove network-legacy completely from the codebase
 - fix(iscsi): replace echo writes with printf to prevent variable injection Resolves: RHEL-170844

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-26532.html

Plugin Details

Severity: High

ID: 328810

File Name: oraclelinux_ELSA-2026-26532.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/21/2026

Updated: 7/21/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.04

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.1

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-6893

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:oracle:linux:10, cpe:/o:oracle:linux:10:2:baseos_patch, p-cpe:/a:oracle:linux:dracut-caps, p-cpe:/a:oracle:linux:dracut-config-generic, p-cpe:/a:oracle:linux:dracut-config-rescue, p-cpe:/a:oracle:linux:dracut-live, p-cpe:/a:oracle:linux:dracut-network, p-cpe:/a:oracle:linux:dracut-squash, p-cpe:/a:oracle:linux:dracut-tools, p-cpe:/a:oracle:linux:dracut

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux

Exploit Ease: No known exploits are available

Patch Publication Date: 7/20/2026

Vulnerability Publication Date: 6/10/2026

Reference Information

CVE: CVE-2026-6893