Back Linuxsecurity

SUSE Linux Micro 6.2 dracut Important Code Injection Vuln 2026-22273

Linuxsecurity •LinuxSecurity Advisories • June 29, 2026

## This update for dracut fixes the following issue * CVE-2026-6893: Root code execution via DHCP options command injection (bsc#1268322). Changes for dracut: * Update to version 059+suse.722.gdd9d67ff5: * fix(network-legacy): sanitize DHCP values in dhclient-script.sh (bsc#1268322, CVE-2026-6893) * fix(network-legacy): add input validation to RFC 3442 route parser ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.2 zypper in -t patch SUSE-SL-Micro-6.2-1067=1 ## Package List: * SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64) * dracut-debuginfo-059+suse.722.gdd9d67ff5-160000.1.1

* CVE-2026-6893 ( SUSE ): 8.7

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

* CVE-2026-6893 ( SUSE ): 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2026-6893 ( NVD ): 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

* SUSE Linux Micro 6.2

An update that solves one vulnerability can now be installed.

Announcement ID: SUSE-SU-2026:22273-1 Release Date: 2026-06-24T21:38:59Z Rating: important

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SUSE Dracut Vulnerability CVE-2026-6893 Allows Root Code Execution via DHCP Injection A critical vulnerability, CVE-2026-6893, has been identified in SUSE's dracut, allowing root code execution through DHCP options command injection. This flaw affects multiple SUSE Linux Enterprise products, including versions 15 SP4 and 16.0, as well as SUSE Linux Micro 6.2. The vulnerability was published on June 10, 2026, and has been addressed in updates released on July 1 and June 24, 2026. The updates include sanitization of DHCP values and input validation improvements. System administrators are advised to apply the patches immediately to mitigate potential exploitation. The CVSS scores for the vulnerability range from 7.5 to 8.8, indicating a high severity level. The flaw could allow attackers to execute arbitrary commands with root privileges, posing a significant risk to affected systems. 7 sources 73

Extracted Entities

SUSE Linux Micro 6.2 dracut Important Code Injection Vuln 2026-22273

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)