Summary
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.
Security Fix(es):
* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)
* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)
* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)
* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 111
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-conf | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-devel | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-doc | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2elasticsearch | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2graphite | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2influxdb | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2json | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2openmetrics | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2opentelemetry | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2spark | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2xml | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-pcp2zabbix | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-export-zabbix-agent | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-geolocate | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-gui | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-benchmarks | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-collectl2pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-ganglia2pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-iostat2pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-mrtg2pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-pmseries | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-import-sar2pcp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-libs | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-libs-devel | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-activemq | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-amdgpu | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-apache | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bash | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bcc | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bind2 | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bonding | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bpf | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-bpftrace | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-cifs | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-cisco | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-dbping | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-denki | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-dm | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-docker | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-ds389 | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-ds389log | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-elasticsearch | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-farm | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-gluster | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-gpfs | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-gpsd | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-hacluster | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-haproxy | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-hdb | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-infiniband | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-libvirt | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-lio | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-lmsensors | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-logger | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-lustre | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-lustrecomm | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mailq | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-memcache | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mic | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mongodb | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mounts | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mssql | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-mysql | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-named | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-netcheck | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-netfilter | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-news | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-nfsclient | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-nginx | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-nvidia-gpu | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-openmetrics | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-opentelemetry | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-openvswitch | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-oracle | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-pdns | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-perfevent | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-podman | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-postfix | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-postgresql | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-rabbitmq | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-redis | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-resctrl | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-rocestat | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-roomtemp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-rsyslog | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-samba | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-sendmail | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-shping | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-slurm | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-smart | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-snmp | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-sockets | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-statsd | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-summary | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-systemd | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-trace | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-unbound | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-uwsgi | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-weblog | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-zimbra | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-pmda-zswap | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-selinux | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-system-tools | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-testsuite | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | pcp-zeroconf | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | perl-PCP-LogImport | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | perl-PCP-LogSummary | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | perl-PCP-MMV | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | perl-PCP-PMDA | 7.0.3-5.el10_2 |
| AlmaLinux · 10 | python3-pcp | 7.0.3-5.el10_2 |
Vulnerabilities 4
-
High 8.8
Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
-
High 7.8
Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
-
High 7.5
Pcp: pcp: denial of service due to signed integer overflow
A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet …
-
High 7.3
Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
References
-
report
https://access.redhat.com/security/cve/CVE-2026-16524
-
report
https://access.redhat.com/security/cve/CVE-2026-16526
-
report
https://access.redhat.com/security/cve/CVE-2026-16527
-
report
https://access.redhat.com/security/cve/CVE-2026-16529
-
report
https://bugzilla.redhat.com/2506023
-
report
https://bugzilla.redhat.com/2506026
-
report
https://bugzilla.redhat.com/2506031
-
report
https://bugzilla.redhat.com/2506032
-
advisory
https://errata.almalinux.org/10/ALSA-2026-55617.html