Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-30T00:00:00 PCP: PCP linux_sockets PMDA: Arbitrary Command Execution via Command Injection 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-78

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

This flaw is rated as Important because it allows a local attacker to achieve arbitrary command execution as the PMDA process user within the Performance Co-Pilot (PCP) environment. Exploitation requires the `linux_sockets` PMDA to be loaded and the `ss` utility to be present, which are common configurations. The vulnerability stems from an inverted validation logic in the `sockets_check_filter()` function, enabling the injection of malicious shell metacharacters into a filter value that is later executed. Red Hat would like to thank Francisco Alisson Bezerra (TIM Security Red Team Research, TIM S.p.A), Lucas Gabriel Alves (TIM Security Red Team Research, TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research, TIM S.p.A) for reporting this issue. To prevent exploitation, restrict access to the `pmstore` utility by configuring the `[access]` section in `/etc/pcp/pmcd/pmcd.conf`. If the `linux_sockets` PMDA is not essential, it can be unloaded or disabled to remove the attack vector. After modifying `pmcd.conf`, the `pmcd` service must be restarted for changes to take effect. Red Hat Enterprise Linux 10 Affected pcp Red Hat Enterprise Linux 6 Out of support scope pcp Red Hat Enterprise Linux 7 Affected pcp Red Hat Enterprise Linux 8 Affected pcp Red Hat Enterprise Linux 9 Affected pcp Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-16524 https://nvd.nist.gov/vuln/detail/CVE-2026-16524