CVE-2026-6893
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A flaw in dracut allows a remote attacker on the adjacent network to inject commands via specially crafted DHCP options (e.g., a malicious hostname). These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. The attacker can achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Risk Assessment
The risk involves remote takeover of the system during early boot, which can lead to persistent system compromise, data theft, or network disruption.
Recommendation
Immediately update the dracut package to the latest patched version. If an update is not possible, restrict trusted DHCP sources in the local network.
Other vulnerabilities in dracut
See all- CVE-2026-15816High
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
- CVE-2026-16445High
A command injection vulnerability in dracut. A remote attacker on the adjacent network can provide crafted DHCP options, leading to code execution in initramfs during system boot.
Original NVD description (English source)
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.