The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26533 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:26532 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:26534 advisory.

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2720-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 055+suse.365.g79144c5:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by     providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious     hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written     into temporary shell scripts without proper escaping, leading to command injection. This allows the     attacker to achieve root code execution within the initramfs, potentially compromising the system's boot     and network behavior. (CVE-2026-6893)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2721-1 advisory.

    This update for dracut fixes the following issue

    - CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322).

    Changes for dracut:

    - Update to version 055+suse.402.g2720eea:
     * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893)
     * fix(network-legacy): add input validation to RFC 3442 route parser

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26532 advisory.

    [107-8.0.1]
    - Suppress stderr for btrfs subvolume check [Orabug: 39059254]
    - fips: add logic for /boot subvolume on BTRFS [Orabug: 36028061]
    - Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306]
    - Include correct modprobe into squashfs root [Orabug: 38559936]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [107-8]
    - revert: 'feat(i18n): pull 'drm' or 'simpledrm' module unless excluded'

    [107-7]
    - build: rebuild without an obsoleted patch

    [107-6]
    - fix(base): escape arguments in initqueue hook script generation
    - fix(net-lib): warn on suspicious shell metacharacters in hostname file
    - fix(systemd-networkd): escape DHCP lease values in dhcpopts generation       Related: RHEL-170844

    [107-5]
    - fix(network-legacy): remove network-legacy completely from the codebase
    - fix(iscsi): replace echo writes with printf to prevent variable injection       Resolves: RHEL-170844

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:26533 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-26533 advisory.

    [057-115.git20260527.0.1]
    - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the     kernel. [Orabug: 38705580]
    - Ship Oracle IMA certificate [Orabug: 35992862]
    - Ship 98-integrity.conf, populating initramfs with Oracle IMA certificate [Orabug: 35992862]
    - Include sys-fs-fuse-connections.mount if needed [Orabug: 35267570]
    - network-legacy: Revert some shellcheck that breaks parse_option_121 in dhclient [Orabug: 33778173]
    - Change installation dir in network legacy module-setup so that file is never missing [Orabug: 33516170]
    - Fix paths in squash module, so that correct modprobe is installed [Orabug: 33514517]
    - Install missing 68-del-part-node.rules [Orabug: 32827579]
    - Fix permission denied error while upgrading from OL8u2 to OL8u3 [Orabug 32160196]
    - dracut-shutdown.service should run before shutdown.target is invoked [Orabug: 29629738]
    - Update list of necessary files after squashfs execution [Orabug: 29864620]
    - Supress iscsidm error output during non-debug PV boot [Orabug: 29846195]
    - Stop block device service in case system is dropped to emergency shell [Orabug: 29851988]
    - Enable booting from block device if netroot=iscsi has failed [Orabug: 29478156]
    - Calculate relative path for kernel and initrd in 51-dracut-rescue.instal [Orabug: 29503293]
    - 40network scripts ifup and netlib updates for iSCSI [Orabug: 28502725]
    - Increase timeout when waiting for carrier detection on a network interface [Orabug: 24657828]     (kevin.x.lyons@oracle.com)
    - add hyperv-keyboard for Hyper-V Gen2 VM [Orabug: 19191303] (Vaughan Cao)

    [057-115.git20260527]
    - build: rebuild without an obsoleted patch

    [057-115.git20260514]
    - fix(network): warn on suspicious shell metacharacters in
    - fix(base): escape arguments in initqueue hook script       Related: RHEL-170857

    [057-113.git20260502]
    - fix(network-legacy): replace echo writes with printf to
    - fix(iscsi): replace echo writes with printf to prevent
    - fix(base): replace eval with safe variable indirection in       Resolves: RHEL-170857

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61252 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script     in die() (CVE-2026-15816)

    * dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module     (CVE-2026-16445)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:62269 advisory.

    The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure     based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel     at boot time and initializes the system, so it can read and boot from the root partition.

    Security Fix(es):

    * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)

    * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script     in die() (CVE-2026-15816)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
321627	RockyLinux 9 : dracut (RLSA-2026:26533)	Nessus	Rocky Linux Local Security Checks	2026/6/20	2026/6/20	high
321668	RockyLinux 10 : dracut (RLSA-2026:26532)	Nessus	Rocky Linux Local Security Checks	2026/6/20	2026/6/20	high
321701	AlmaLinux 8 : dracut (ALSA-2026:26534)	Nessus	Alma Linux Local Security Checks	2026/6/20	2026/6/20	high
324844	SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2720-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/7/2	high
320498	Linux Distros Unpatched Vulnerability : CVE-2026-6893	Nessus	Misc.	2026/6/11	2026/9/2	high
324870	SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2721-1)	Nessus	SuSE Local Security Checks	2026/7/2	2026/7/2	high
328810	Oracle Linux 10 : dracut (ELSA-2026-26532)	Nessus	Oracle Linux Local Security Checks	2026/7/21	2026/7/21	high
321353	RHEL 9 : dracut (RHSA-2026:26533)	Nessus	Red Hat Local Security Checks	2026/6/17	2026/6/17	high
322994	Oracle Linux 9 : dracut (ELSA-2026-26533)	Nessus	Oracle Linux Local Security Checks	2026/6/26	2026/6/26	high
341626	RHEL 8 : dracut (RHSA-2026:61252)	Nessus	Red Hat Local Security Checks	2026/8/31	2026/8/31	high
342246	RHEL 7 : dracut (RHSA-2026:62269)	Nessus	Red Hat Local Security Checks	2026/9/1	2026/9/1	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high