Bug 2506026 (CVE-2026-16526)

Summary: CVE-2026-16526 PCP: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: kgaikwad, rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-07-30   

Description OSIDB Bzimport 2026-07-22 07:26:46 UTC 
Summary: When the linux_sockets PMDA is loaded as a DSO inside PMCD, code execution
achieved via Vulnerability 3 (network.persocket.filter injection) can be escalated from user
pcp to root. The pmdarootfd Unix socket connection to pmdaroot is created without
O_CLOEXEC, causing all child processes spawned by popen() to inherit it. pmdaroot runs as
root and processes PDUROOT_STARTPMDA_REQ without per-request authentication,
executing attacker-controlled arguments via execvp() as root.
Prerequisites:
• Vulnerability 3 (linux_sockets command injection) required for initial code execution
- exploitable either locally via pmcd (TCP 44321, localhost only by default) or
remotely via the pmproxy REST API (TCP 44322, all interfaces by default, no
authentication required). linux_sockets
• PMDA loaded as DSO in PMCD (requires explicit configuration in pmcd.conf; default
is daemon mode).