Command Injection via Unescaped DHCP Options in dracut Legacy Path
CVE-2026-6893 Published on June 10, 2026
Dracut: dracut: root code execution via dhcp options command injection
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 50 days later.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-6893 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-6893
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
