CVE-2026-6893 Details

A command injection vulnerability has been identified in the dracut utility, specifically within the legacy DHCP client script. This flaw allows a remote attacker on the same network segment to exploit the system by sending specially crafted DHCP options, such as a malicious hostname. The improperly handled options are written into temporary shell scripts without adequate escaping, creating a command injection risk. Exploitation of this vulnerability enables the attacker to execute arbitrary commands as root within the initramfs, potentially disrupting the system's boot process and network functionality.

Systems using dracut and configured to obtain network settings via DHCP during the initramfs phase should be booted on trusted networks. If not strictly necessary, consider using static network configurations.