CVE-2026-16526: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-16526 is a privilege escalation vulnerability in the Performance Co-Pilot (PCP) linux_sockets PMDA (Performance Metrics Domain Agent) module that allows an attacker with initial code execution to escalate privileges and execute arbitrary commands as root. The flaw was reported on July 22, 2026, and publicly disclosed on July 30, 2026. Affected products include PCP on Red Hat Enterprise Linux, Red Hat OpenShift Container Platform, and Red Hat CoreOS (RHCOS). It carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-403 (Exposure of File Descriptor to Unintended Control Sphere / File Descriptor Leak). Specifically, when the linux_sockets PMDA is loaded as a DSO (Dynamic Shared Object) inside PMCD, the pmdarootfd Unix socket connection to the pmdaroot daemon is created without the O_CLOEXEC flag. This causes all child processes spawned via popen() to inherit the file descriptor. The pmdaroot daemon runs as root and processes PDUROOT_STARTPMDA_REQ messages without per-request authentication, executing attacker-controlled arguments via execvp() as root. Exploitation requires initial code execution first achieved through a separate vulnerability (e.g., command injection via network.persocket.filter), reachable either locally via PMCD on TCP port 44321 or remotely via the pmproxy REST API on TCP port 44322 (no authentication required by default), and the linux_sockets PMDA must be configured to load as a DSO in pmcd.conf rather than the default daemon mode (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation grants an attacker full root-level command execution on the affected host, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can read or exfiltrate any data on the system, modify or destroy system files, and disrupt services. The ability to execute arbitrary commands as root also enables lateral movement within the network and potential persistence mechanisms (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify hosts running PCP services — scan for TCP port 44321 (PMCD) and TCP port 44322 (pmproxy REST API). Determine if the linux_sockets PMDA is loaded as a DSO in pmcd.conf (non-default configuration).
2. Initial Code Execution (Prerequisite): Exploit the network.persocket.filter command injection vulnerability (referenced as "Vulnerability 3" in the bug report) via the pmproxy REST API on TCP 44322 (no authentication required) or locally via PMCD on TCP 44321 to achieve code execution as the pcp user.
3. Identify Inherited File Descriptor: As the pcp user, enumerate open file descriptors (e.g., via /proc/self/fd) to locate the inherited pmdarootfd Unix socket connection to the pmdaroot daemon, which was not closed with O_CLOEXEC.
4. Send Malicious PDUROOT_STARTPMDA_REQ: Craft and send a PDUROOT_STARTPMDA_REQ message over the inherited socket with attacker-controlled arguments. Since pmdaroot performs no per-request authentication, it will process the request.
5. Achieve Root Execution: The pmdaroot daemon executes the attacker-supplied arguments via execvp() as root, granting full root-level command execution on the system (Red Hat Bugzilla).

• Network: Unexpected connections to TCP port 44322 (pmproxy REST API) from external or unauthorized hosts; unusual outbound connections from the PCP service host following pmproxy access.
• Process: Unexpected child processes spawned by pmdaroot or pmcd (e.g., shells, curl, wget, reverse shell binaries); processes running as root with a parent PID associated with PCP daemons.
• File System: New or modified files in system directories (e.g., /etc/cron.d/, /root/, /tmp/) created by the pcp or root user unexpectedly; new SUID binaries or unauthorized SSH keys added to /root/.ssh/authorized_keys.
• Logs: Unusual entries in PCP logs (/var/log/pcp/) referencing linux_sockets PMDA or pmdaroot activity; pmproxy access logs showing unexpected API calls with filter parameters; auditd logs showing execvp() calls from pmdaroot with unusual arguments.

Apply the available patch from Red Hat for PCP on affected platforms (Red Hat Enterprise Linux, OpenShift Container Platform, RHCOS) as tracked in Bugzilla bug 2506026. As a workaround, ensure the linux_sockets PMDA is configured to run in daemon mode (the default) rather than DSO mode in pmcd.conf, which prevents the file descriptor inheritance chain. Additionally, restrict network access to the pmproxy REST API (TCP 44322) using firewall rules to limit exposure to the prerequisite injection vulnerability, and restrict access to PMCD (TCP 44321) to trusted hosts only (Red Hat CVE, Red Hat Bugzilla).