Summary
Performance Co-Pilot (PCP) is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems.
Security Fix(es):
* PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection (CVE-2026-16524)
* PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability (CVE-2026-16526)
* PCP: PCP pmproxy: Unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVE-2026-16527)
* PCP: PCP: Denial of Service due to signed integer overflow (CVE-2026-16529)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | pcp | 0:6.3.7-8.el9_8.4 |
Vulnerabilities 4
-
High 8.8
Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
-
High 7.8
Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection
A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
-
High 7.5
Pcp: pcp: denial of service due to signed integer overflow
A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet …
-
High 7.3
Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules
An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.