Critical Security Flaw in dracut Package: Root Code Execution via DHCP Options Command Injection
Summary
ALSA-2026:26533: Important: dracut security update. Affects dracut versions < 057-115.git20260527.el9_8. Fixed in 057-115.git20260527.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dracut package is an essential component of the AlmaLinux operating system, serving as an event-driven initial RAM file system (initramfs) generator. It utilizes the udev device manager to create a virtual file system that is loaded alongside the kernel during the boot process. This functionality is crucial as it initializes the system and enables it to read and boot from the root partition. The dracut package, along with its associated components, is widely used in various environments, making its security a top priority.
Vulnerability Detail
The vulnerability identified as CVE-2026-6893 allows for root code execution through DHCP options command injection. This flaw arises from improper handling of DHCP options, which can be exploited by an attacker to execute arbitrary code with root privileges. The implications of this vulnerability are severe, as it could lead to unauthorized access and control over the affected systems, potentially compromising sensitive data and system integrity.
How To Fix
Minimum fixed version
057-115.git20260527.el9_8
This is the first release that contains the fix.
sudo dnf update dracutTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as possible to mitigate the risk.
Conclusion
The dracut package has a critical vulnerability (CVE-2026-6893) that allows for root code execution through DHCP options command injection. It is imperative to update to the patched version 057-115.git20260527.el9_8 to secure your systems. Regular monitoring and timely updates are essential to maintaining system integrity and security.
See every vulnerability recorded for dracut →
FAQ
CVE-2026-6893 allows attackers to execute arbitrary code with root privileges, potentially compromising the entire system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk as soon as possible.
The vulnerability affects all versions prior to the fixed version 057-115.git20260527.el9_8.
The components affected include dracut, dracut-caps, dracut-config-generic, dracut-config-rescue, dracut-live, dracut-network, dracut-squash, and dracut-tools.
Related vulnerabilities
Recent vulnerabilities recorded for dracut.
