The vulnerability CVE-2026-6893 exists in dracut, an initramfs generator used in Red Hat Enterprise Linux 9 and 10. The flaw arises because DHCP options, such as hostnames received from the network, are improperly handled and embedded into temporary shell scripts without proper escaping. This allows an attacker on the adjacent network to inject OS commands during the early boot phase, achieving root code execution within initramfs. The vulnerability affects versions >=9.0 <9.9 and >=10.0 <10.3. Red Hat has issued security advisories RHSA-2026:26532 and RHSA-2026:26533 providing updated dracut packages that fix this issue.

Successful exploitation allows an attacker on the adjacent network to execute arbitrary commands as root during the system's early boot process (initramfs). This can lead to full system compromise, affecting confidentiality, integrity, and availability. The vulnerability impacts the boot and network initialization, potentially allowing persistent and stealthy control over the affected system.

Red Hat has released official security updates for dracut that address this vulnerability. Users should apply the updates as described in Red Hat advisories RHSA-2026:26532 (for RHEL 10) and RHSA-2026:26533 (for RHEL 9). The advisories include detailed instructions and updated package versions. Applying these updates mitigates the vulnerability effectively. No additional mitigations are required beyond applying the official patches.