Bug 2511464

Summary: CVE-2026-16526 pcp: PCP: Privilege escalation to root via linux_sockets PMDA vulnerability [fedora-all]
Product: [Fedora] Fedora Reporter: Srikanth Balasubramanian <sbalasub>
Component: pcpAssignee: William Cohen <wcohen>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: agerstmayr, jcgutierrez0102, jkurik, lchilton, nathans, sfeifer, wcohen
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["612ff6fb-8a0f-4c60-bc81-1c731f768ebd"]}
Fixed In Version: pcp-7.2.0-1.fc45 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2026-08-07 20:13:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2506026    

Description Srikanth Balasubramanian 2026-08-05 12:05:21 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Summary: When the linux_sockets PMDA is loaded as a DSO inside PMCD, code execution
achieved via Vulnerability 3 (network.persocket.filter injection) can be escalated from user
pcp to root. The pmdarootfd Unix socket connection to pmdaroot is created without
O_CLOEXEC, causing all child processes spawned by popen() to inherit it. pmdaroot runs as
root and processes PDUROOT_STARTPMDA_REQ without per-request authentication,
executing attacker-controlled arguments via execvp() as root.
Prerequisites:
• Vulnerability 3 (linux_sockets command injection) required for initial code execution
- exploitable either locally via pmcd (TCP 44321, localhost only by default) or
remotely via the pmproxy REST API (TCP 44322, all interfaces by default, no
authentication required). linux_sockets
• PMDA loaded as DSO in PMCD (requires explicit configuration in pmcd.conf; default
is daemon mode).
Comment 1 William Cohen 2026-08-07 20:13:15 UTC 
This CVE has been addressed in the new pcp-7.2.0-1 RPM builds available for Fedora Rawhide, Fedora 44, and Fedora 43.