CVE-2026-16530

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management.

Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.(CVE-2026-16530)

Performance Co-Pilot (PCP) provides a framework and services to support system-level performance monitoring and performance management.

Security Fix(es):

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.(CVE-2026-16524)

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.(CVE-2026-16526)

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.(CVE-2026-16527)

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.(CVE-2026-16529)

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.(CVE-2026-16530)

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

• PCP: PCP: Remote denial of service and information leakage (CVE-2026-16530)

• PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet (CVE-2026-16531)

Bug Fix(es) and Enhancement(s):

• [Downstream] Rebase to the v7.1.3 or newer in 10.3 (JIRA:Rocky Linux-173456)

• Cockpit reports "Metrics history could not be loaded" when some older pmlogger metrics are corrupted (JIRA:Rocky Linux-139714)

• pcp-pmda-hdb and pcp-pmda-postgresql ship active default credentials in configuration files (JIRA:Rocky Linux-152221)

• [Rocky Linux 10.2] PCP (pcp-zeroconf) now pulls a new set of additional packages that are not really required by default (JIRA:Rocky Linux-180384)

• Remove legacy pcp-pmda-bcc package from Rocky Linux 10 and in favor of pcp-pmda-bpf (JIRA:Rocky Linux-188397)

• Update of MSSQL PMDA to work with msodbcsql v18 (JIRA:Rocky Linux-177599)

• Migrate to libvalkey from hiredis/hiredis-cluster (JIRA:Rocky Linux-108916)

• pcp2openmetrics reports only the first metric when uses pmlogger archives (JIRA:Rocky Linux-114006)

• pcp2opentelemetry generates output that is incompatible with OTLP/protobuf (JIRA:Rocky Linux-130463)

• "opentelemetry.control.status_code" metric does not report failing scripts (JIRA:Rocky Linux-130499)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.

Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.

Security Fix(es):

• PCP: PCP: Remote denial of service and information leakage (CVE-2026-16530)

Bug Fix(es) and Enhancement(s):

• [pcp pmda ds389] some metrics display error of compatibility (JIRA:Rocky Linux-159914)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

A flaw was found in the PCP (Performance Co-Pilot) pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom() function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.

These are all security issues fixed in the libpcp-devel-6.3.8-3.1 package on the GA media of openSUSE Tumbleweed.

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• Command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• Command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).

This update for pcp fixes the following issues:

• CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
• CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
• CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
• CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
• CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
• CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
• command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
• command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).