CVE-2026-6893: Dracut: dracut: root code execution via dhcp options command injection

Synopsis

This is a command injection vulnerability in dracut, the initramfs-building tool used across Red Hat Enterprise Linux and related platforms. An attacker on the same network segment can send specially crafted DHCP options (such as a malicious hostname) to a booting system; because dracut's legacy DHCP path writes those options directly into temporary shell scripts without escaping them, the attacker gains root code execution inside the initramfs. Successful exploitation gives the attacker full control over the system's boot sequence and network configuration. No upstream fix has been published; HarborGuard is tracking this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network, LAN, or VPN segment as the target system; remote over-the-internet exploitation is not possible.

• AuthenticationNot required

  No credentials or account are needed; the attack is delivered through unauthenticated DHCP responses on the local network.

• Victim interactionNot required

  No user action is required; the vulnerable code path is triggered automatically when the target system processes DHCP options during boot.

• Attack complexityDetail

  Exploitation involves high attack complexity, meaning the attacker may need to meet specific timing or environmental conditions, such as racing the DHCP exchange during the initramfs boot phase.

Blast Radius

• The attacker executes arbitrary commands as root inside the initramfs, with full control over the early boot environment.
• Boot-time network configuration can be modified, redirecting the system to attacker-controlled resources or disabling network security controls before the main OS loads.
• Persistent compromise of the boot sequence is achievable, allowing the attacker to tamper with the root filesystem or inject malicious components before integrity checks run.
• All three impact dimensions are high: the attacker reads, modifies, and can destroy data or crash the system entirely from the initramfs stage.