CVE-2026-16526: Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Summary: When the linuxsockets PMDA is loaded as a DSO inside PMCD, code execution achieved via Vulnerability 3 (network.persocket.filter injection) can be escalated from user pcp to root. The pmdarootfd Unix socket connection to pmdaroot is created without OCLOEXEC, causing all child processes spawned by popen() to inherit it. pmdaroot runs as root and processes PDUROOTSTARTPMDAREQ without per-request authentication, executing attacker-controlled arguments via execvp() as root. Prerequisites: • Vulnerability 3 (linuxsockets command injection) required for initial code execution - exploitable either locally via pmcd (TCP 44321, localhost only by default) or remotely via the pmproxy REST API (TCP 44322, all interfaces by default, no authentication required). linuxsockets • PMDA loaded as DSO in PMCD (requires explicit configuration in pmcd.conf; default is daemon mode).

— Red Hat