A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.

This is an Important denial of service vulnerability in PCP due to a signed integer overflow. An unauthenticated remote attacker could exhaust resources by sending a specially crafted request to the pmlogger or pmcd services, leading to a permanent denial of service for the affected daemon. While both services are typically bound to the loopback interface by default, remote exploitation is possible if the default binding configuration is altered or if PMLOGGER_LOCAL is unset for pmlogger. Red Hat would like to thank Francisco Alisson Bezerra (TIM Security Red Team Research, TIM S.p.A), Lucas Gabriel Alves (TIM Security Red Team Research, TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research, TIM S.p.A) for reporting this issue. To mitigate this issue, ensure that Performance Co-Pilot (PCP) services, specifically `pmlogger` and `pmcd`, are not exposed to untrusted networks. By default, these services are configured to listen only on the loopback interface, which prevents remote exploitation. If these default network bindings have been altered, revert them to restrict access to localhost. For `pmlogger`, ensure the `PMLOGGER_LOCAL` environment variable is set. If remote access to PCP services is not required, consider implementing firewall rules to block external connections to TCP ports 4330 (pmlogger) and 44321 (pmcd). Changes to network configurations or environment variables may require restarting the affected PCP services for the mitigation to take effect. Red Hat Enterprise Linux 10 2026-08-17T00:00:00Z RHSA-2026:55617 pcp-0:7.0.3-5.el10_2 Red Hat Enterprise Linux 8 2026-08-17T00:00:00Z RHSA-2026:55560 pcp-0:5.3.7-22.el8_10.5 Red Hat Enterprise Linux 9 2026-08-17T00:00:00Z RHSA-2026:55740 pcp-0:6.3.7-8.el9_8.4 Red Hat Enterprise Linux 6 Out of support scope pcp Red Hat Enterprise Linux 7 Affected pcp Red Hat OpenShift Container Platform 4 Not affected rhcos https://www.cve.org/CVERecord?id=CVE-2026-16529 https://nvd.nist.gov/vuln/detail/CVE-2026-16529