Loading story…
Red Hat and SUSE disclosed DHCP-related command injection flaws that can let an attacker on the same or adjacent network execute code during system boot. CVE-2026-6893 affects dracut's legacy networking path, where DHCP-supplied values such as host-name are written into temporary shell scripts by modules.d/35network-legacy/dhclient-script.sh and later sourced as root inside initramfs. On systems booting with configurations such as ip=dhcp and rd.neednet=1, a malicious DHCP server can abuse the legacy dhclient flow to achieve root code execution before the operating system fully starts.
SUSE separately assigned CVE-2026-44932 to wicked, which writes DHCP option values into /run/wicked/leaseinfo.* files without sufficient sanitization. Although wicked does not directly source those files, downstream scripts and components that do can execute attacker-controlled shell metacharacters delivered in DHCP responses, creating an indirect remote shell injection path that SUSE said can reach root-level execution in components including dracut's network-legacy module on SLE 15 SP7. Both disclosures tie the risk to unsafe handling of untrusted DHCP data in early-boot networking, and SUSE said it issued security updates across affected product lines.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A SUSE Bugzilla report disclosed CVE-2026-44932 in wicked, where insufficiently sanitized DHCP option values written to leaseinfo files could lead to indirect shell command injection when sourced by downstream scripts or modules. The report states SUSE published multiple important security updates across affected product lines to address the issue.
A Red Hat Bugzilla report documented CVE-2026-6893 in dracut's legacy DHCP path, describing how DHCP-supplied values could be written into temporary shell scripts and later sourced as root in initramfs, enabling root code execution from a malicious DHCP server on the same Layer 2 segment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
bugzilla.suse.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FreeBSD Project disclosed **CVE-2026-42511**, a critical vulnerability in the default IPv4 DHCP client, `dhclient(8)`, that can allow a local network attacker to execute arbitrary code as **root**. The flaw arises because `dhclient(8)` does not properly escape double quotes in the BOOTP file field before writing data to the DHCP lease file, allowing a malicious DHCP response to inject configuration content that is later re-parsed and executed by `dhclient-script(8)`. Exploitation requires the attacker to be on the same broadcast domain and operate a rogue DHCP server that replies with crafted DHCP data. FreeBSD said the issue affects all currently supported branches, including **FreeBSD 15.0, 14.4, 14.3, and 13.5** release and stable versions, and published patches in security advisory **FreeBSD-SA-26:12.dhclient**. Administrators were urged to update immediately, and FreeBSD noted that switch-level **DHCP snooping** can help mitigate attacks from rogue DHCP servers where continued use of `dhclient` is necessary.
Jun 29, 2026
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026