Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×
This update for pcp fixes the following issues:
* CVE-2026-16524: command injection in `linux_sockets` PMDA via
`network.persocket.filter` (bsc#1272922).
* CVE-2026-16526: pmdaroot privilege escalation via `FD_CLOEXEC` fd
inheritance and missing peer credentials (bsc#1272923).
* CVE-2026-16527: missing authentication flags in pmproxy REST API
* CVE-2026-16529: integer overflow in `__pmGetPDU` leads to permanent DoS
* CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders
* CVE-2026-16531: path traversal via hostname in pmproxy logger servlet
* Command injection in `pmieconf` `write_pmiefile` via `$ ` and `-f`
* Command injection in `pmlogcp/pmlogmv` `do_link` via unsanitised filenames
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-3505=1
* SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-3505=1
* SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-3505=1
* SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-3505=1
zypper in -t patch SUSE-2026-3505=1
* SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* pcp-system-tools-6.2.0-150500.8.9.1
* pcp-system-tools-debuginfo-6.2.0-150500.8.9.1
* perl-PCP-LogImport-6.2.0-150500.8.9.1
* perl-PCP-LogSummary-6.2.0-150500.8.9.1
* perl-PCP-MMV-6.2.0-150500.8.9.1
* libpcp3-debuginfo-6.2.0-150500.8.9.1
* pcp-devel-6.2.0-150500.8.9.1
* python3-pcp-debuginfo-6.2.0-150500.8.9.1
* libpcp_import1-6.2.0-150500.8.9.1
* perl-PCP-LogImport-debuginfo-6.2.0-150500.8.9.1
* libpcp3-6.2.0-150500.8.9.1
* libpcp_import1-debuginfo-6.2.0-150500.8.9.1
* libpcp_web1-6.2.0-150500.8.9.1
* pcp-devel-debuginfo-6.2.0-150500.8.9.1
* perl-PCP-MMV-debuginfo-6.2.0-150500.8.9.1
* perl-PCP-PMDA-6.2.0-150500.8.9.1
* libpcp_gui2-6.2.0-150500.8.9.1
* python3-pcp-6.2.0-150500.8.9.1
* libpcp_trace2-debuginfo-6.2.0-150500.8.9.1
* libpcp_gui2-debuginfo-6.2.0-150500.8.9.1
* pcp-debuginfo-6.2.0-150500.8.9.1
* libpcp_mmv1-debuginfo-6.2.0-150500.8.9.1
* libpcp_trace2-6.2.0-150500.8.9.1
* libpcp_web1-debuginfo-6.2.0-150500.8.9.1
*
*
*
*
*
*
*
*
*
*
*
*
*
*
Get the latest Linux and open source security news straight to your inbox.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
