CVE-2026-6893

Discovered by AISLEPUBLISHEDCWE-78

Description

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

CVSS Base Scores

CVSS v3.1(Primary)
7.5

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersionStatus
Red HatRed Hat Enterprise Linux 100:107-7.el10_2unaffected
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support0:105-4.el10_0.1unaffected
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION0:004-413.el6_10unaffected
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support0:033-577.el7_9unaffected
Red HatRed Hat Enterprise Linux 80:049-244.git20260529.el8_10unaffected
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support0:049-138.git20220131.el8_4.1unaffected
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On0:049-138.git20220131.el8_4.1unaffected
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support0:049-203.git20220511.el8_6.1unaffected
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On0:049-203.git20220511.el8_6.1unaffected
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service0:049-223.git20230119.el8_8.1unaffected
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions0:049-223.git20230119.el8_8.1unaffected
Red HatRed Hat Enterprise Linux 90:057-115.git20260527.el9_8unaffected
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions0:057-25.git20250717.el9_2.2unaffected
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions0:057-54.git20250423.el9_4.3unaffected
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support0:057-89.git20250311.el9_6.1unaffected
Red HatRed Hat OpenShift Container Platform 4.13413.92.202609080414-0unaffected
Red HatRed Hat OpenShift Container Platform 4.14414.92.202609011250-0unaffected
Red HatRed Hat OpenShift Container Platform 4.15415.92.202609140326-0unaffected
Red HatRed Hat OpenShift Container Platform 4.16416.94.202609011112-0unaffected
Red HatRed Hat OpenShift Container Platform 4.17417.94.202609191027-0unaffected
Red HatRed Hat OpenShift Container Platform 4.18418.94.202609031320-0unaffected
Red HatRed Hat OpenShift Container Platform 4.18418.94.202609171815-0unaffected
Red HatRed Hat OpenShift Container Platform 4.194.19.9.6.202609021231-0unaffected
Red HatRed Hat Hardened Images109-6.hum1unaffected
Red HatRed Hat OpenShift Container Platform 4——

Credits

  • Red Hat would like to thank AISLE Research for reporting this issue.

References