Executive brief
A vulnerability in the Performance Co-Pilot (PCP) monitoring suite can allow a remote attacker to crash system monitoring services. By sending a specially crafted network packet, an attacker can permanently disable the affected background service (daemon), preventing it from processing any further data. This results in a total loss of monitoring capabilities for the affected system until the service is manually restarted.
Technical details
A signed integer overflow exists in the __pmGetPDU() function within pdu.c of the Performance Co-Pilot (PCP) suite. When a crafted PDU length (e.g., 0x7FFFFFFF) is processed, the expression used to calculate buffer size overflows to a negative value, permanently corrupting the process-wide static variable 'maxsize'. Consequently, all subsequent calls to __pmFindPDUBuf(maxsize) return NULL, causing the daemon to silently fail all future packet reads. The vulnerability is reachable via pmlogger (TCP 4330) or pmcd (TCP 44321) during SASL negotiation, requiring no authentication. While often bound to loopback by default, it is remotely exploitable if the service is configured to listen on external interfaces.
Affected products
- Red Hat Performance Co-Pilot (PCP) RHEL 7, 8, 9, 10; OpenShift 4
Timeline
- 2026-07-22: disclosed: Reported to Red Hat Bugzilla
- 2026-07-30: advisory: NVD and Red Hat published advisory details