CVE-2026-16526: Red Hat PCP privilege escalation in linux_sockets PMDA

CVE-2026-16526 · Severity: high · CVSS 8.8 · Published 2026-07-30

A security flaw in Performance Co-Pilot (PCP), a system monitoring toolkit, allows an attacker who has already gained limited access to take full control of the system. By exploiting an unsecured internal connection within the monitoring software, an attacker can bypass security boundaries to execute commands with administrative (root) privileges. This could lead to a complete system takeover, data theft, or permanent disruption of services on affected Linux servers and OpenShift clusters.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Red Hat.

Quick answers

Is CVE-2026-16526 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-16526 being exploited in the wild.
How severe is CVE-2026-16526?
High severity, with a CVSS score of 8.8, published 30 July 2026.
Which products and versions are affected?
Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 7 affected; Red Hat Enterprise Linux 8 affected; Red Hat Enterprise Linux 9 affected; and 1 more.
Is there a fix for CVE-2026-16526?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16526 attacked?
It is attacked over the network or with local access, in an operating system.
Am I affected by CVE-2026-16526?
Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the Performance Co-Pilot (PCP) linux_sockets Performance Metrics Domain Agent (PMDA). When the PMDA is loaded as a Dynamic Shared Object (DSO) within the Performance Metrics Collector Daemon (PMCD), it fails to set the O_CLOEXEC flag on the pmdarootfd Unix socket connection. This causes child processes spawned via popen() to inherit the file descriptor. An attacker who has achieved initial code execution (e.g., via command injection in the linux_sockets module) can use this inherited descriptor to send a PDUROOT_STARTPMDA_REQ to the pmdaroot process. Because pmdaroot runs as root and lacks per-request authentication, it will execute attacker-controlled arguments via execvp(), resulting in full root privilege escalation.

Affected products

  • Red Hat Red Hat Enterprise Linux 7 affected
  • Red Hat Red Hat Enterprise Linux 8 affected
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Red Hat Red Hat OpenShift Container Platform 4 affected

Timeline

  • 2026-07-22: disclosed: Reported via Red Hat Bugzilla
  • 2026-07-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.