CVE-2026-6893: Dracut: dracut: root code execution via dhcp options command injection

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Red Hat Enterprise Linux 10

  • 0:107-7.el10_2 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

  • 0:105-4.el10_0.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION

  • 0:004-413.el6_10 and laternot affected · rpm
  • 0:004-414.el6_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

  • 0:033-577.el7_9 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8

  • 0:049-244.git20260529.el8_10 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

  • 0:049-138.git20220131.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

  • 0:049-138.git20220131.el8_4.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

  • 0:049-203.git20220511.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

  • 0:049-203.git20220511.el8_6.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

  • 0:049-223.git20230119.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

  • 0:049-223.git20230119.el8_8.1 and laternot affected · rpm

• Red Hat Red Hat Enterprise Linux 9

  • 0:057-115.git20260527.el9_8 and laternot affected · rpm
  • 0:057-115.git20260527.el9_8 and laternot affected · rpm

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2025-10230Samba: command injection in wins server hook script
  52Plan
• CVE-2026-4631Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
  44Plan
• CVE-2026-76578Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci
  39Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-3238Jun 8, 2026 · Samba: denial of service against ad dc wins server
  31Monitor
• ← EarlierCVE-2026-11837Jun 10, 2026 · Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
  29Monitor
• Later →CVE-2026-53701Jun 11, 2026 · Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser
  26Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.