Bug 2506032 (CVE-2026-16529)

Summary:	CVE-2026-16529 PCP: PCP: Denial of Service due to signed integer overflow
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	kgaikwad, rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-07-30

Description OSIDB Bzimport 2026-07-22 07:49:33 UTC

Summary: A signed integer overflow in __pmGetPDU() (pdu.c:661) permanently corrupts
the process-wide static variable maxsize, rendering the affected daemon unable to read any
PDU for the remainder of its lifetime. No authentication or prior session state is required.
When php->len = 0x7FFFFFFF, the expression PDU_CHUNK * (1 + php->len / PDU_CHUNK)
overflows to -2147483648. Every subsequent call to __pmFindPDUBuf(maxsize) returns
NULL, causing silent connection failures. Two attack vectors were confirmed: pmlogger TCP
4330 (conditional on PMLOGGER_LOCAL being unset) and pmcd TCP 44321 during SASL
negotiation.
Prerequisites: Vector 1 (pmlogger TCP 4330): Default installation, no credentials required.
Bound to loopback by default; remotely exploitable only if PMLOGGER_LOCAL is unset.
Vector 2 (pmcd TCP 44321): SASL configured (standard in major distro packages). Bound to
loopback by default; remotely exploitable only if the operator altered the binding
configuration.