ALAS2-2026-3812

Amazon Linux 2 Security Advisory: ALAS2-2026-3812
Advisory Released Date: 2026-07-20
Advisory Updated Date: 2026-07-20
Severity: Important
Issue Overview:

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior. (CVE-2026-6893)


Affected Packages:

dracut


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update dracut or yum update --advisory ALAS2-2026-3812 to update your system.

New Packages:
aarch64:
    dracut-033-535.amzn2.1.7.aarch64
    dracut-network-033-535.amzn2.1.7.aarch64
    dracut-fips-033-535.amzn2.1.7.aarch64
    dracut-fips-aesni-033-535.amzn2.1.7.aarch64
    dracut-caps-033-535.amzn2.1.7.aarch64
    dracut-config-generic-033-535.amzn2.1.7.aarch64
    dracut-config-rescue-033-535.amzn2.1.7.aarch64
    dracut-tools-033-535.amzn2.1.7.aarch64
    dracut-debuginfo-033-535.amzn2.1.7.aarch64

i686:
    dracut-033-535.amzn2.1.7.i686
    dracut-network-033-535.amzn2.1.7.i686
    dracut-fips-033-535.amzn2.1.7.i686
    dracut-fips-aesni-033-535.amzn2.1.7.i686
    dracut-caps-033-535.amzn2.1.7.i686
    dracut-config-generic-033-535.amzn2.1.7.i686
    dracut-config-rescue-033-535.amzn2.1.7.i686
    dracut-tools-033-535.amzn2.1.7.i686
    dracut-debuginfo-033-535.amzn2.1.7.i686

src:
    dracut-033-535.amzn2.1.7.src

x86_64:
    dracut-033-535.amzn2.1.7.x86_64
    dracut-network-033-535.amzn2.1.7.x86_64
    dracut-fips-033-535.amzn2.1.7.x86_64
    dracut-fips-aesni-033-535.amzn2.1.7.x86_64
    dracut-caps-033-535.amzn2.1.7.x86_64
    dracut-config-generic-033-535.amzn2.1.7.x86_64
    dracut-config-rescue-033-535.amzn2.1.7.x86_64
    dracut-tools-033-535.amzn2.1.7.x86_64
    dracut-debuginfo-033-535.amzn2.1.7.x86_64

Additional References

Release Notes:  Amazon Linux 2 Release Notes

Red Hat: CVE-2026-6893

Mitre: CVE-2026-6893