RLSA-2026:98620: Important: grafana-pcp security update
The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.
Security Fix(es):
github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input (CVE-2026-116591)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/grafana-pcpto a version that resolves this vulnerability.Fixed in 0:6.1.0-2.el10_3.3 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debuginfoto a version that resolves this vulnerability.Fixed in 0:6.1.0-2.el10_3.3 - Upgrade
Upgrade
rocky-linux/grafana-pcp-debugsourceto a version that resolves this vulnerability.Fixed in 0:6.1.0-2.el10_3.3
Event History
Frequently Asked Questions
What systems are exposed to this denial-of-service issue?
Systems with the affected Rocky Linux grafana-pcp package installed are in scope. The advisory also lists the corresponding grafana-pcp-debuginfo and grafana-pcp-debugsource packages.
What does an attacker need to exploit the issue?
The CVSS vector indicates exploitation is network-accessible, requires low attack complexity, and does not require privileges or user interaction. The issue is triggered by crafted zstd-compressed input and affects availability.
What is the expected impact of successful exploitation?
Successful exploitation can cause a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.