UnratedFix available

UBUNTU-CVE-2026-6893

Type: advisorySource: OSV1 source record

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

Announced 10 Jun 2026Group revision 1

Original source ↗

UBUNTU-CVE-2026-6893

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2026-6893

dracut

Source reference: /affected/0/package/name

Affected versions: 043-2
Source reference: /affected/0/versions
043-4
Source reference: /affected/0/versions
044+3-1
Source reference: /affected/0/versions
044+3-2
Source reference: /affected/0/versions
044+3-3
Source reference: /affected/0/versions
Fixed versions: 044+3-3ubuntu0.1~esm1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/1/package/name

Affected versions: 045+132-1
Source reference: /affected/1/versions
047-2
Source reference: /affected/1/versions
Fixed versions: 047-2ubuntu0.1~esm1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/2/package/name

Affected versions: 048+80-2
Source reference: /affected/2/versions
Fixed versions: 048+80-2ubuntu0.1~esm1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/3/package/name

Affected versions: 051-1
Source reference: /affected/3/versions
Fixed versions: 051-1ubuntu0.1~esm1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/4/package/name

Affected versions: 059-4ubuntu2
Source reference: /affected/4/versions
060+5-1ubuntu1
Source reference: /affected/4/versions
060+5-1ubuntu2
Source reference: /affected/4/versions
060+5-1ubuntu3
Source reference: /affected/4/versions
060+5-1ubuntu3.1
Source reference: /affected/4/versions
060+5-1ubuntu3.2
Source reference: /affected/4/versions
060+5-1ubuntu3.3
Source reference: /affected/4/versions
Fixed versions: 060+5-1ubuntu3.4
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

dracut

Source reference: /affected/5/package/name

Affected versions: 106-2ubuntu5
Source reference: /affected/5/versions
107-1ubuntu1
Source reference: /affected/5/versions
107-1ubuntu3
Source reference: /affected/5/versions
107-1ubuntu5
Source reference: /affected/5/versions
108-1ubuntu1
Source reference: /affected/5/versions
108-2ubuntu1
Source reference: /affected/5/versions
108-3ubuntu2
Source reference: /affected/5/versions
108-3ubuntu3
Source reference: /affected/5/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "044+3-3ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "043-2",
      "043-4",
      "044+3-1",
      "044+3-2",
      "044+3-3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "044+3-3ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "047-2ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "045+132-1",
      "047-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "047-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "047-2ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "048+80-2ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "048+80-2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "048+80-2ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "051-1ubuntu0.1~esm1"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=esm-apps%2Fjammy",
      "ecosystem": "Ubuntu:Pro:22.04:LTS"
    },
    "versions": [
      "051-1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-live",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "051-1ubuntu0.1~esm1"
        },
        {
          "binary_name": "dracut-squash",
          "binary_version": "051-1ubuntu0.1~esm1"
        }
      ],
      "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "060+5-1ubuntu3.4"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=noble",
      "ecosystem": "Ubuntu:24.04:LTS"
    },
    "versions": [
      "059-4ubuntu2",
      "060+5-1ubuntu1",
      "060+5-1ubuntu2",
      "060+5-1ubuntu3",
      "060+5-1ubuntu3.1",
      "060+5-1ubuntu3.2",
      "060+5-1ubuntu3.3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-config-generic",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-config-rescue",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-install",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-live",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "060+5-1ubuntu3.4"
        },
        {
          "binary_name": "dracut-squash",
          "binary_version": "060+5-1ubuntu3.4"
        }
      ],
      "availability": "No subscription required"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "dracut",
      "purl": "pkg:deb/ubuntu/dracut?arch=source&distro=questing",
      "ecosystem": "Ubuntu:25.10"
    },
    "versions": [
      "106-2ubuntu5",
      "107-1ubuntu1",
      "107-1ubuntu3",
      "107-1ubuntu5",
      "108-1ubuntu1",
      "108-2ubuntu1",
      "108-3ubuntu2",
      "108-3ubuntu3"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-6893.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "dracut",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-core",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-install",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-live",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-network",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-squash",
          "binary_version": "108-3ubuntu3"
        },
        {
          "binary_name": "dracut-test",
          "binary_version": "108-3ubuntu3"
        }
      ]
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #23724 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 06:23:53 GMT
Publisher date: Wed, 10 Jun 2026 20:17:00 GMT

Read the original announcement

Revision history

25 Oct 2026UBUNTU-CVE-2026-6893 · Revision 1Source updated