CVE-2026-6893: dracut OS Command Injection

CVSS: 7.5v3.1HighAwaiting analysis

AliasesSUSE-SU-2026:22273-1SUSE-SU-2026:22358-1SUSE-SU-2026:22431-1+12 more

Published 10-06-2026Last modified 08-10-2026

Vulnerability summary

CVE-2026-6893 is a high (CVSS 7.5) OS Command Injection vulnerability in dracut. EPSS estimates a 3.14% chance of exploitation in the next 30 days, higher than 87.7% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

3.14%

0%100%

Low · +1.86 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

10-06-2026
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.5

EPSS trend

Probability

3.14%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

+1.86 pp

From 1.27% on 20-09-2026

20-09-202620-10-2026

EPSS score

3.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Affected systems

Suse21 products

dracut&distro=SUSE Linux Enterprise High Availability Extension 15 SP6< 059+suse.565.g682306ec5-150600.3.29.1
dracut&distro=SUSE Linux Enterprise High Availability Extension 15 SP7< 059+suse.570.g2b84048d7-150700.3.17.1
dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 055+suse.365.g79144c5-150400.3.49.1
dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 055+suse.365.g79144c5-150400.3.49.1
dracut&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 055+suse.402.g2720eea-150500.3.41.1

Show all 21

Redhat10 products

dracut< 0:109-6.hum1 | < 0:107-7.el10_2 | < 0:057-115.git20260527.el9_8
dracut-caps< 0:109-6.hum1 | < 0:107-7.el10_2 | < 0:057-115.git20260527.el9_8
dracut-config-generic< 0:109-6.hum1 | < 0:107-7.el10_2 | < 0:057-115.git20260527.el9_8
dracut-config-rescue< 0:109-6.hum1 | < 0:107-7.el10_2 | < 0:057-115.git20260527.el9_8
dracut-debuginfo< 0:107-7.el10_2 | < 0:057-115.git20260527.el9_8

Show all 10

Opensuse2 products

dracut&distro=openSUSE Leap 16.0< 059+suse.722.gdd9d67ff5-160000.1.1
dracut&distro=openSUSE Tumbleweed< 110+suse.35.g9834432-1.1

Debian1 product

dracutAll versions (No fix recorded) | < 112-1

Ubuntu1 product

dracut< 044+3-3ubuntu0.1~esm1 | < 047-2ubuntu0.1~esm1 | < 048+80-2ubuntu0.1~esm1 | < 051-1ubuntu0.1~esm1 | < 060+5-1ubuntu3.4 | All versions (No fix recorded)

5 vendors · 35 products