UBUNTU-CVE-2026-6893

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-6893
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-6893
Upstream
  • CVE-2026-6893
Published
2026-06-10T20:17:00Z
Modified
2026-09-15T03:15:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

References

Affected packages

Ubuntu:16.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
043-2
043-4
044+3-1
044+3-2
044+3-3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "044+3-3"
        },
        {
            "binary_name": "dracut-config-generic",
            "binary_version": "044+3-3"
        },
        {
            "binary_name": "dracut-config-rescue",
            "binary_version": "044+3-3"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "044+3-3"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "044+3-3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:18.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
045+132-1
047-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "047-2"
        },
        {
            "binary_name": "dracut-config-generic",
            "binary_version": "047-2"
        },
        {
            "binary_name": "dracut-config-rescue",
            "binary_version": "047-2"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "047-2"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "047-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:20.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
048+80-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "048+80-2"
        },
        {
            "binary_name": "dracut-config-generic",
            "binary_version": "048+80-2"
        },
        {
            "binary_name": "dracut-config-rescue",
            "binary_version": "048+80-2"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "048+80-2"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "048+80-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:22.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
051-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-config-generic",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-config-rescue",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-live",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "051-1"
        },
        {
            "binary_name": "dracut-squash",
            "binary_version": "051-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:24.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
059-4ubuntu2
060+5-1ubuntu1
060+5-1ubuntu2
060+5-1ubuntu3
060+5-1ubuntu3.*
060+5-1ubuntu3.1
060+5-1ubuntu3.2
060+5-1ubuntu3.3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-config-generic",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-config-rescue",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-install",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-live",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "060+5-1ubuntu3.3"
        },
        {
            "binary_name": "dracut-squash",
            "binary_version": "060+5-1ubuntu3.3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:25.10
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
106-2ubuntu5
107-1ubuntu1
107-1ubuntu3
107-1ubuntu5
108-1ubuntu1
108-2ubuntu1
108-3ubuntu2
108-3ubuntu3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-install",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-live",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-squash",
            "binary_version": "108-3ubuntu3"
        },
        {
            "binary_name": "dracut-test",
            "binary_version": "108-3ubuntu3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
Ubuntu:26.04:LTS
dracut

Package

Name
dracut
Purl
pkg:deb/ubuntu/dracut?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

Other
108-3ubuntu3
108-8ubuntu1
109-5ubuntu1
109-7ubuntu1
109-9ubuntu1
109-11ubuntu1
110-1ubuntu2
110-3ubuntu1
110-5
110-7
110-10
110-11
110-11ubuntu0.*
110-11ubuntu0.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "dracut",
            "binary_version": "110-11ubuntu0.1"
        },
        {
            "binary_name": "dracut-core",
            "binary_version": "110-11ubuntu0.1"
        },
        {
            "binary_name": "dracut-install",
            "binary_version": "110-11ubuntu0.1"
        },
        {
            "binary_name": "dracut-network",
            "binary_version": "110-11ubuntu0.1"
        },
        {
            "binary_name": "dracut-test",
            "binary_version": "110-11ubuntu0.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"