CVE-2026-16526

Awaiting Analysis Awaiting Analysis - Queue

Linux Sockets Module Privilege Escalation

Publication date: 2026-07-30

Last updated on: 2026-08-18

Assigner: redhat-SADP

Description

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16526

EUVD

EUVD-2026-50971

Affected Vendors & Products

Vendor	Product	Version / Range
performance_co_pilot	pcp	to 2026-07-30 (inc)
performance_co_pilot	performance_co_pilot	to 2026-07-30 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-403	A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Attack-Flow Graph

Executive Summary

This is a privilege escalation vulnerability in Performance Co-Pilot (PCP) software. It occurs in the linux_sockets module when a PMDA is loaded as a DSO inside PMCD. An attacker with initial code execution can exploit a socket injection flaw to escalate privileges from user 'pcp' to root by abusing an unsecured Unix socket connection.

Detection Guidance

Check if the PCP linux_sockets PMDA is loaded as a DSO in PMCD by inspecting pmcd.conf for 'linux_sockets' entries. Verify if the pmdarootfd Unix socket lacks the O_CLOEXEC flag using lsof or netstat. Monitor for unexpected child processes spawned by popen() inheriting the socket. Inspect PMCD logs for unusual PMDA start requests or execvp() calls.

Impact Analysis

If you use PCP with the linux_sockets module configured as a DSO in PMCD, an attacker who gains initial access could escalate privileges to root. This could allow them to execute arbitrary commands, take full control of the system, or steal sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized root access, compromising system integrity and data confidentiality. This may violate compliance requirements for GDPR (data protection), HIPAA (health data security), and other regulations mandating strict access controls and auditability.

Mitigation Strategies

Disable the linux_sockets PMDA in pmcd.conf if loaded as a DSO. Restrict access to PMCD (TCP 44321) and pmproxy (TCP 44322) to trusted networks only. Update PCP to the latest patched version. Monitor for unauthorized root-level command executions via PMDA logs.

Hi! I’m here to help you understand CVE-2026-16526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70