Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Falha crítica no dracut (CVE-2026-6893) afeta Rocky Linux e RHEL. Atacante na mesma rede pode executar código como root no boot via DHCP. Saiba mais: -> http://shorturl.at/bUHRb https://t.co/6eN76DePAt
Post summary
A critical dracut vulnerability (CVE-2026-6893) can let an attacker execute code as root during boot via DHCP on Rocky Linux and RHEL, but no patch, exploit code, or PoC is provided.