CVE-2026-6893: Dracut DHCP Command Injection Vulnerability – Root Code Execution in Initramfs

Technical summary

The vulnerability resides in dracut's legacy DHCP client path, where Dynamic Host Configuration Protocol responses are processed during initramfs boot. Specifically, DHCP options—including hostname and other configuration parameters—are incorporated into temporary shell scripts without adequate input sanitization or escaping. This classic command injection flaw (CWE-78) permits an adjacent network attacker to embed shell metacharacters and commands within DHCP option payloads. When the initramfs executes these scripts, the injected commands run with root privileges in the boot environment, before the main operating system kernel fully initializes. The attack surface is particularly exposed during network boot scenarios or systems relying on DHCP for early-stage network configuration.

Business impact

Compromising a system's boot environment is particularly severe because it grants an attacker foundational control before the running OS can apply security policies or endpoint detection tools. An adversary exploiting this flaw can modify boot behavior, persist malware in the initramfs, intercept credentials during network boot, or disable security mechanisms during startup. In data center or cloud environments where systems are frequently reprovisioned or boot over the network, this vulnerability poses a risk to infrastructure integrity. Organizations relying on secure boot chains, network-based OS deployment, or systems running dracut in automated provisioning pipelines face elevated exposure. Recovery requires re-imaging or manual intervention, increasing operational disruption.

Affected systems

Any system using dracut—a widespread initramfs generation tool found on Red Hat, Fedora, CentOS, RHEL, and other Linux distributions—is potentially affected if it relies on the legacy DHCP client path during boot. Systems that boot via PXE, use network-based OS provisioning, or depend on DHCP for early network configuration face the greatest risk. Embedded systems, IoT devices, and hypervisor nodes that employ dracut are also vulnerable. Systems using modern networkd or other DHCP implementations as the primary method may have lower exposure, depending on their dracut configuration. The vendor product list should be verified against your specific distribution and dracut version.

Exploitability

Exploitation requires the attacker to be on the same local network segment (AV:A in CVSS terms), but no authentication or user interaction is needed. The attacker must be able to respond to DHCP requests, typically by running a rogue DHCP server or intercepting legitimate DHCP traffic. While this requires some network positioning, it is not difficult in environments with insufficient DHCP snooping, port security, or network segmentation. The CVSS score of 7.5 reflects high impact (confidentiality, integrity, and availability all compromised) balanced against the requirement for adjacent network access and potentially high complexity to set up the attack. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog, but the straightforward nature of DHCP spoofing and command injection suggests that practical exploits could emerge quickly.

Remediation

Organizations should prioritize patching dracut to a version that properly escapes DHCP options before incorporating them into shell scripts. Until patches are deployed, network segmentation and DHCP snooping controls can reduce exposure by limiting rogue DHCP servers. Disabling the legacy DHCP path in favor of modern network configuration methods (if feasible for your environment) lowers attack surface. Systems that do not require DHCP-based network boot should ensure dracut is not installed or is configured to skip DHCP processing. Additionally, monitoring for unexpected DHCP option injection attempts and network boot anomalies can provide detection during the remediation window.

Patch guidance

Consult your Linux distribution's security advisory for dracut patches released after the vulnerability publication date (2026-06-10). Red Hat, Fedora, and other downstream projects typically issue fixes through their package management systems (yum, dnf, apt). Patches should address proper escaping or sanitization of DHCP options before they are written to temporary scripts. Test patches in a non-production environment first, particularly on systems that boot via PXE or rely on DHCP configuration, to ensure network boot functionality is preserved. Verify patch application by checking dracut version numbers against vendor advisories and confirming that DHCP option handling has been hardened.

Detection guidance

Monitor for malformed or unusually long DHCP option values during boot—especially hostnames and domain names containing shell metacharacters (backticks, dollar signs, semicolons, pipes). Network-based detection should flag DHCP responses originating from unauthorized servers on the segment. Host-based detection is challenging because the attack occurs in the initramfs before logging is fully available; however, examine system logs and boot logs for signs of unexpected command execution or network behavior changes following system boot. If secure boot is enabled, monitor for unsigned initramfs or unexpected modifications. Intrusion detection systems (IDS) can identify DHCP injection patterns if they inspect DHCP payloads. Endpoint detection and response (EDR) tools should alert on anomalous processes spawned during early boot phases.

Why prioritize this

This vulnerability merits immediate attention because it targets the boot process—the foundation of system trust—and requires only network proximity and no authentication. Root code execution in the initramfs is particularly dangerous because it occurs before the kernel and security tools fully activate. While exploitation complexity is moderate (requiring network positioning), the impact is severe and could affect large numbers of systems in networked environments. Organizations with significant Linux infrastructure, particularly those using network boot or dracut-based provisioning, should treat this as high priority for patching and mitigation.

Risk score, explained

The CVSS 7.5 HIGH severity score reflects the combination of high impact (all three CIA triad elements compromised—C:H, I:H, A:H) against moderate exploitability barriers. Adjacent network access (AV:A) and high attack complexity (AC:H) prevent a critical rating, but the consequence of root-level code execution during boot justifies the HIGH classification. For organizations where systems boot over untrusted networks or operate in shared network environments, the practical risk may warrant treating this as critical internally. The absence from CISA's KEV list does not diminish severity; it reflects current observed exploitation rather than technical severity.

Frequently asked questions