Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-10T19:39:00 dracut: dracut: Root code execution via DHCP options command injection 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-78

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.

This is an Important vulnerability in dracut's legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase. Red Hat would like to thank AISLE Research for reporting this issue. To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration. Red Hat Enterprise Linux 10 2026-06-17T00:00:00Z RHSA-2026:26532 dracut-0:107-7.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-08-20T00:00:00Z RHSA-2026:57580 dracut-0:105-4.el10_0.1 Red Hat Enterprise Linux 7 Extended Lifecycle Support 2026-09-01T00:00:00Z RHSA-2026:62269 dracut-0:033-577.el7_9 Red Hat Enterprise Linux 8 2026-06-17T00:00:00Z RHSA-2026:26534 dracut-0:049-244.git20260529.el8_10 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-08-31T00:00:00Z RHSA-2026:61252 dracut-0:049-223.git20230119.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-08-31T00:00:00Z RHSA-2026:61252 dracut-0:049-223.git20230119.el8_8.1 Red Hat Enterprise Linux 9 2026-06-17T00:00:00Z RHSA-2026:26533 dracut-0:057-115.git20260527.el9_8 Red Hat Enterprise Linux 9 2026-06-17T00:00:00Z RHSA-2026:26533 dracut-0:057-115.git20260527.el9_8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-08-20T00:00:00Z RHSA-2026:57775 dracut-0:057-25.git20250717.el9_2.2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-08-20T00:00:00Z RHSA-2026:57785 dracut-0:057-54.git20250423.el9_4.3 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-08-20T00:00:00Z RHSA-2026:57772 dracut-0:057-89.git20250311.el9_6.1 Red Hat OpenShift Container Platform 4.16 2026-09-10T00:00:00Z RHSA-2026:62549 rhcos-416.94.202609011112-0 Red Hat OpenShift Container Platform 4.19 2026-09-09T00:00:00Z RHSA-2026:63044 rhcos-4.19.9.6.202609021231-0 Red Hat Hardened Images 2026-06-17T00:00:00Z RHSA-2026:26713 dracut-main-109-6.hum1 Red Hat Enterprise Linux 6 Affected dracut Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 https://www.cve.org/CVERecord?id=CVE-2026-6893 https://nvd.nist.gov/vuln/detail/CVE-2026-6893