Command Injection via Unescaped DHCP Options in dracut Legacy Path
CVE-2026-6893 Published on June 10, 2026
Dracut: dracut: root code execution via dhcp options command injection
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Vulnerability Analysis
Timeline
Reported to Red Hat.
Made public. 50 days later.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2026-6893 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2026-6893
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
Affected Versions
Red Hat Enterprise Linux 10:- Version 0:107-7.el10_2 and below * is unaffected.
- Version 0:049-244.git20260529.el8_10 and below * is unaffected.
- Version 0:057-115.git20260527.el9_8 and below * is unaffected.
- Version 0:057-115.git20260527.el9_8 and below * is unaffected.
- Version 109-6.hum1 and below * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.