Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #92959 > unrolled thread

Bug#1139725: dracut: CVE-2026-6893: Root code execution via DHCP options command injection

Back to article view | Back to linux.debian.kernel

Contents

  Bug#1139725: dracut: CVE-2026-6893: Root code execution via DHCP options command injection Salvatore Bonaccorso <carnil@debian.org> - 2026-06-12 06:10 +0200
    Bug#1139725: marked as done (dracut: CVE-2026-6893: Root code  execution via DHCP options command injection) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2026-08-03 02:40 +0200

#92959 — Bug#1139725: dracut: CVE-2026-6893: Root code execution via DHCP options command injection

Source: dracut
Version: 111-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/dracut-ng/dracut/pull/2469
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for dracut.

CVE-2026-6893[0]:
| A flaw was found in dracut. A remote attacker on the adjacent
| network can exploit this vulnerability by providing specially
| crafted DHCP (Dynamic Host Configuration Protocol) options, such as
| a malicious hostname, to a system using dracut's legacy DHCP path.
| These options are improperly handled and written into temporary
| shell scripts without proper escaping, leading to command injection.
| This allows the attacker to achieve root code execution within the
| initramfs, potentially compromising the system's boot and network
| behavior.

Only main reference is the bugzilla entry from Red Hat[1] but there is
a draft merge request upsream now at time of writing[2].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-6893
    https://www.cve.org/CVERecord?id=CVE-2026-6893
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2459963
[2] https://github.com/dracut-ng/dracut/pull/2469

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

[toc] | [next] | [standalone]

#93559 — Bug#1139725: marked as done (dracut: CVE-2026-6893: Root code execution via DHCP options command injection)

[Multipart message — attachments visible in raw view] — view raw

Your message dated Mon, 03 Aug 2026 00:35:07 +0000
with message-id <E1wqge3-00000003yQl-1Kr7@fasolo.debian.org>
and subject line Bug#1139725: fixed in dracut 112-1
has caused the Debian Bug report #1139725,
regarding dracut: CVE-2026-6893: Root code execution via DHCP options command injection
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1139725: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139725
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web