CVE-2026-16524

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.

This flaw is rated as Important because it allows a local attacker to achieve arbitrary command execution as the PMDA process user within the Performance Co-Pilot (PCP) environment. Exploitation requires the linux_sockets PMDA to be loaded and the ss utility to be present, which are common configurations. The vulnerability stems from an inverted validation logic in the sockets_check_filter() function, enabling the injection of malicious shell metacharacters into a filter value that is later executed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To prevent exploitation, restrict access to the pmstore utility by configuring the [access] section in /etc/pcp/pmcd/pmcd.conf. If the linux_sockets PMDA is not essential, it can be unloaded or disabled to remove the attack vector. After modifying pmcd.conf, the pmcd service must be restarted for changes to take effect.