CVE-2026-16526
Received Received - Intake

Linux Sockets Module Privilege Escalation

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: Red Hat, Inc.

Description
A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-16526
EUVD
EUVD-2026-50971

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
performance_co_pilot performance_co_pilot to 2026-07-30 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-403 A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in Performance Co-Pilot (PCP) software. It occurs in the linux_sockets module when a PMDA is loaded as a DSO inside PMCD. An attacker with initial code execution can exploit a socket injection flaw to escalate privileges from user 'pcp' to root by abusing an unsecured Unix socket connection.

Detection Guidance

Check if the PCP linux_sockets PMDA is loaded as a DSO in PMCD by inspecting pmcd.conf for 'linux_sockets' entries. Verify if the pmdarootfd Unix socket lacks the O_CLOEXEC flag using lsof or netstat. Monitor for unexpected child processes spawned by popen() inheriting the socket. Inspect PMCD logs for unusual PMDA start requests or execvp() calls.

Impact Analysis

If you use PCP with the linux_sockets module configured as a DSO in PMCD, an attacker who gains initial access could escalate privileges to root. This could allow them to execute arbitrary commands, take full control of the system, or steal sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized root access, compromising system integrity and data confidentiality. This may violate compliance requirements for GDPR (data protection), HIPAA (health data security), and other regulations mandating strict access controls and auditability.

Mitigation Strategies

Disable the linux_sockets PMDA in pmcd.conf if loaded as a DSO. Restrict access to PMCD (TCP 44321) and pmproxy (TCP 44322) to trusted networks only. Update PCP to the latest patched version. Monitor for unauthorized root-level command executions via PMDA logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16526. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart