{"id":"CVE-2026-6893","title":"A flaw was found in dracut","summary":"A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracu…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"vendor":"Red Hat","product":"dracut","affected":["dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","dracut (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","rhcos (all versions)","dracut-main (all versions)","dracut (all versions)","openshift/ose-rhel-coreos-8 (all versions)"],"patched":["enterprise_linux_server_v_7_els","openshift_container_platform 4.19","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_e4s_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","hardened_images"],"published":"2026-06-10","updated":"2026-09-21","sourceUpdated":"2026-09-21T04:17:35.603","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-6893","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:26532","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26533","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26534","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26713","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57580","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57772","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57775","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57785","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61252","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:62269","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:62409","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:62549","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63044","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65839","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:65851","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69118","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69119","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-6893","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459963","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:26532","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26533","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26534","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:26713","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57580","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57772","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57775","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57785","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61252","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:62269","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:62409","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:62549","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63044","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65839","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:65851","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-6893","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2459963","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6893.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6893"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6893"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-12T12:29:45.330884Z"},"epss":0.01275,"epssPercentile":0.68164,"ingestedAt":"2026-08-20T20:00:36.920Z","slug":"CVE-2026-6893","body":"## Overview\n\nA flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:62269** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62269)\n- **RHSA-2026:63044** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:63044)\n- **RHSA-2026:26532** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26532)\n- **RHSA-2026:26533** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26533)\n- **RHSA-2026:57580** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57580)\n- **RHSA-2026:26534** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26534)\n- **RHSA-2026:61252** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8) · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61252)\n- **RHSA-2026:57775** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57775)\n- **RHSA-2026:57785** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.4) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57785)\n- **RHSA-2026:57772** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2026-08-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:57772)\n- **RHSA-2026:26713** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:26713)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6893.json)\n- **RHSA-2026:62549** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:62549)\n- **RHSA-2026:62409** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:62409)\n- **RHSA-2026:65851** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65851)\n- **RHSA-2026:65839** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:65839)\n- **RHSA-2026:69118** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69118)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}