{
  "threat_severity" : "Important",
  "public_date" : "2026-06-10T19:39:00Z",
  "bugzilla" : {
    "description" : "dracut: dracut: Root code execution via DHCP options command injection",
    "id" : "2459963",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-78",
  "details" : [ "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.", "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior." ],
  "statement" : "This is an Important vulnerability in dracut's legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase.",
  "acknowledgement" : "Red Hat would like to thank AISLE Research for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26532",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "dracut-0:107-7.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57580",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "dracut-0:105-4.el10_0.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-09-01T00:00:00Z",
    "advisory" : "RHSA-2026:62269",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "dracut-0:033-577.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26534",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "dracut-0:049-244.git20260529.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61252",
    "cpe" : "cpe:/o:redhat:rhel_tus:8.8",
    "package" : "dracut-0:049-223.git20230119.el8_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61252",
    "cpe" : "cpe:/o:redhat:rhel_e4s:8.8",
    "package" : "dracut-0:049-223.git20230119.el8_8.1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26533",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "dracut-0:057-115.git20260527.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26533",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "dracut-0:057-115.git20260527.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57775",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.2",
    "package" : "dracut-0:057-25.git20250717.el9_2.2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57785",
    "cpe" : "cpe:/a:redhat:rhel_e4s:9.4",
    "package" : "dracut-0:057-54.git20250423.el9_4.3"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9.6 Extended Update Support",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:57772",
    "cpe" : "cpe:/a:redhat:rhel_eus:9.6",
    "package" : "dracut-0:057-89.git20250311.el9_6.1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26713",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "dracut-main-109-6.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "dracut",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-6893\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6893" ],
  "name" : "CVE-2026-6893",
  "mitigation" : {
    "value" : "To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration.",
    "lang" : "en:us"
  },
  "csaw" : false
}