Critical Security Flaw in dracut Package: Root Code Execution via DHCP Options Command Injection
Summary
ALSA-2026:26532: Important: dracut security update. Affects dracut versions < 107-7.el10_2. Fixed in 107-7.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dracut package is an event-driven initial RAM file system (initramfs) generator that utilizes the udev device manager. It plays a crucial role in the boot process by loading the virtual file system alongside the kernel, enabling the system to read and boot from the root partition. This package is essential for system initialization and configuration, making it a key component in many Linux distributions, including AlmaLinux.
Vulnerability Detail
The vulnerability identified as CVE-2026-6893 allows for root code execution through DHCP options command injection. This issue arises when the dracut package improperly handles DHCP options, potentially allowing an attacker to execute arbitrary code with root privileges. The ramifications of this vulnerability are severe, as it could lead to complete system compromise, unauthorized access, and manipulation of sensitive data.
How To Fix
Minimum fixed version
107-7.el10_2
This is the first release that contains the fix.
sudo dnf update dracutTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable DHCP options in their network configuration to mitigate the risk of exploitation until the package is updated. However, this may affect network connectivity and should be approached with caution.
Conclusion
The dracut package has a critical vulnerability (CVE-2026-6893) that allows for root code execution through DHCP options command injection. It is imperative to update to the patched version (107-7.el10_2) to secure your system. Users should also consider temporary workarounds to minimize risk until the update is applied.
See every vulnerability recorded for dracut →
FAQ
Dracut is an initramfs generator that creates a minimal environment for booting Linux systems, allowing them to load necessary drivers and configurations.
CVE-2026-6893 is a vulnerability in the dracut package that allows for root code execution through improper handling of DHCP options.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to the system, potential data breaches, and the ability for attackers to execute arbitrary code with root privileges.
Yes, temporarily disabling DHCP options in your network configuration can help mitigate the risk until the patch is applied.
Related vulnerabilities
Recent vulnerabilities recorded for dracut.
