CVE-2026-16529: 
Linux Debian Analyse et atténuation des vulnérabilités

CVE-2026-16529 is a signed integer overflow vulnerability in the Performance Co-Pilot (PCP) __pmGetPDU() function (pdu.c:661) that can be exploited via crafted network packets during PDU processing or SASL negotiation. Successful exploitation permanently corrupts the process-wide static variable maxsize, rendering the affected daemon unable to read any subsequent PDU — resulting in a total denial of service (DoS). Affected products include the pcp package on Red Hat Enterprise Linux 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4 (via rhcos); RHEL 6 status is listed as unknown. The vulnerability was reported on July 22, 2026 and publicly disclosed on July 30, 2026, with a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is a signed integer overflow (CWE-190) in __pmGetPDU() within pdu.c at line 661. When a crafted packet sets php->len to 0x7FFFFFFF, the expression PDU_CHUNK * (1 + php->len / PDU_CHUNK) overflows to -2147483648, permanently corrupting the static variable maxsize. Every subsequent call to __pmFindPDUBuf(maxsize) then returns NULL, causing silent connection failures for the lifetime of the daemon process. Two attack vectors are confirmed: Vector 1 targets pmlogger on TCP port 4330 (exploitable remotely only if PMLOGGER_LOCAL is unset; no credentials required by default), and Vector 2 targets pmcd on TCP port 44321 during SASL negotiation (exploitable remotely only if the operator altered the default loopback binding) (Red Hat Bugzilla).

Exploitation results in a permanent denial of service for the affected PCP daemon — once the maxsize variable is corrupted, the daemon cannot process any further PDU reads for the remainder of its lifetime without a restart. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Affected daemons include pmlogger and pmcd, which are core components of the PCP performance monitoring infrastructure, meaning exploitation could blind system administrators to performance metrics and disrupt monitoring pipelines on affected RHEL and OpenShift systems (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify hosts running PCP daemons (pmlogger on TCP 4330, pmcd on TCP 44321) using network scanning tools such as nmap. Determine whether the target has PMLOGGER_LOCAL unset or has pmcd bound to a non-loopback interface, which is required for remote exploitation.
2. Craft malicious PDU: Construct a network packet targeting __pmGetPDU() with php->len set to 0x7FFFFFFF (2147483647). This value causes the expression PDU_CHUNK * (1 + php->len / PDU_CHUNK) to overflow to -2147483648 when processed by the daemon.
3. Deliver the packet: Send the crafted packet to the target daemon — either to pmlogger on TCP port 4330 (no credentials required) or to pmcd on TCP port 44321 during the SASL negotiation phase.
4. Trigger permanent DoS: The overflow corrupts the process-wide static variable maxsize. All subsequent calls to __pmFindPDUBuf(maxsize) return NULL, permanently blinding the daemon to further PDU reads without requiring any additional interaction (Red Hat Bugzilla).

• Network: Unexpected inbound TCP connections to port 4330 (pmlogger) or port 44321 (pmcd) from external or untrusted IP addresses, particularly if these services are normally bound to loopback.
• Network: Single crafted packets with anomalously large PDU length fields (e.g., 0x7FFFFFFF) directed at PCP service ports.
• Logs: PCP daemon logs showing repeated NULL returns from __pmFindPDUBuf() or silent connection failures following an unusual inbound connection.
• Process: pmlogger or pmcd processes that become unresponsive to all subsequent PDU reads without crashing — appearing alive but failing to process any monitoring data.
• Logs: System logs (/var/log/messages or journald) showing PCP daemon errors or warnings related to PDU buffer allocation failures after an unexpected network event (Red Hat Bugzilla).

Red Hat has acknowledged the vulnerability and a patch is noted as available (bug filed against the pcp package); users should apply updated pcp packages from Red Hat once errata are published for their respective RHEL versions (Red Hat CVE, Red Hat Bugzilla). As an immediate workaround, ensure PMLOGGER_LOCAL is set (the default) to restrict pmlogger to loopback, and verify that pmcd is not bound to external interfaces unless operationally required. Network-level controls such as firewall rules blocking external access to TCP ports 4330 and 44321 will significantly reduce the attack surface for remote exploitation.