CVE-2026-16524: Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

A command injection vulnerability exists in the linuxsockets PMDA through the writable metric network.persocket.filter. The validation helper socketscheckfilter() returns 1 for safe input and 0 for unsafe input, but the store handler uses an inverted condition: safe expressions are rejected while malicious ones containing shell metacharacters are silently accepted. The attacker-controlled filter value is later incorporated into a shell command executed via popen() whenever socket metrics are refreshed, enabling arbitrary command execution as the PMDA process user. Prerequisites: • linuxsockets PMDA loaded; • ss binary present (/usr/sbin/ss or /usr/bin/ss); • no [access] section restricting pmstore in pmcd.conf (default behavior).

— Red Hat