CVE-2026-16524: PCP linux_sockets PMDA RCE Vulnerability

CVE-2026-16524 Overview

CVE-2026-16524 is a command injection vulnerability [CWE-78] in the Performance Co-Pilot (PCP) linux_sockets Performance Metrics Domain Agent (PMDA). The flaw resides in the handling of the network.persocket.filter metric, which fails to validate shell metacharacters supplied over the network. When the PMDA refreshes metrics, attacker-controlled input passes to a shell context and executes as the PMDA user. Red Hat tracks this issue under Red Hat CVE Advisory CVE-2026-16524 and Red Hat Bug Report #2506023.

Critical Impact
Authenticated local attackers can execute arbitrary commands as the PMDA user, compromising confidentiality, integrity, and availability on affected PCP hosts.

Affected Products

Performance Co-Pilot (PCP) linux_sockets PMDA
Red Hat Enterprise Linux distributions shipping the affected PCP package
Linux systems using PCP for socket-level performance metrics

Discovery Timeline

2026-07-30 - CVE-2026-16524 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-16524

Vulnerability Analysis

The PCP linux_sockets PMDA exposes socket-level performance telemetry to PCP clients. The network.persocket.filter metric accepts a filter expression from clients and uses it to shape which sockets are enumerated during metric refresh. The PMDA passes this filter value into a shell-interpreted context without stripping or escaping shell metacharacters.

An attacker who can write to this metric injects characters such as ;, |, `, or $() to break out of the intended argument and run arbitrary commands. Execution occurs each time the metric refreshes, giving the attacker reliable code execution as the PMDA service account. The mapped weakness is OS Command Injection [CWE-78].

Root Cause

The root cause is missing input validation on the network.persocket.filter metric value. The PMDA trusts client-supplied filter strings and concatenates them into a command line that a shell later interprets. No allowlist, escaping routine, or execve-style argument-vector invocation isolates the attacker input from shell parsing.

Attack Vector

Exploitation requires local access with low privileges, matching the CVSS AV:L/PR:L scope. An attacker uses standard PCP client tooling, such as pmstore, to set the network.persocket.filter metric to a malicious payload. When the PMDA next refreshes socket metrics, the shell evaluates the injected metacharacters and runs the attacker's commands under the PMDA account. Successful exploitation yields lateral movement, credential theft, or persistence on the monitored host.

Detection Methods for CVE-2026-16524

Indicators of Compromise

Unexpected child processes spawned by the PCP PMDA process tree, particularly sh -c invocations with unusual arguments.
pmstore or PMAPI writes targeting network.persocket.filter containing shell metacharacters such as ;, |, `, $(, or &&.
New outbound network connections or file writes originating from the PMDA service account outside its normal profile.

Detection Strategies

Audit PCP logs and PMDA activity for writes to the network.persocket.filter metric and correlate with process creation events on the host.
Deploy Linux auditd rules that flag execve events where the parent process is the linux_sockets PMDA and the command line does not match a known baseline.
Alert on shell interpreter processes launched by any PMDA binary, which is not part of normal PCP operation.

Monitoring Recommendations

Forward PCP daemon logs and host process telemetry to a central analytics platform for correlation across the fleet.
Baseline the expected process tree of the PCP PMDA and alert on deviations, especially spawned shells or network utilities.
Track privileged local users with access to PCP client tools and review their command history for filter-metric writes.

How to Mitigate CVE-2026-16524

Immediate Actions Required

Apply the PCP package update provided by your distribution as soon as it is available; consult the Red Hat CVE Advisory CVE-2026-16524 for fixed versions.
Restrict local access to hosts running the linux_sockets PMDA to trusted administrators only.
Remove or disable PCP client utilities on hosts where interactive users do not require them.

Patch Information

Red Hat is tracking remediation through Red Hat Bug Report #2506023. Administrators should monitor vendor advisories for the fixed PCP package version, apply it through standard package management, and restart the pmcd service to load the patched PMDA.

Workarounds

Disable the linux_sockets PMDA in pmcd.conf if socket-level metrics are not required for operations.
Constrain the PMDA service account with SELinux or AppArmor policies that block shell execution and outbound network activity.
Limit membership in local groups that can invoke pmstore and other PCP write-capable clients.

bash

# Disable the linux_sockets PMDA until a patch is applied
sudo sed -i '/^linux_sockets/s/^/#/' /var/lib/pcp/pmdas/linux_sockets/domain.h 2>/dev/null
sudo systemctl restart pmcd
sudo pminfo -f network.persocket.filter || echo "PMDA disabled successfully"