CVE-2026-16524 is a command injection vulnerability in the linux_sockets PMDA of the Performance Co-Pilot (PCP) monitoring framework. The vulnerability arises from insufficient validation of the network.persocket.filter metric, which permits injection of shell metacharacters. This allows an attacker with local access and low privileges to execute arbitrary commands as the PMDA user when metrics are refreshed. The CVSS 3.1 vector indicates low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows arbitrary command execution with the privileges of the PMDA user, potentially leading to full compromise of the affected system's monitoring component and unauthorized control over system operations. The vulnerability impacts confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided Red Hat advisory link does not explicitly state the availability of a fix or mitigation steps. Until an official fix is released, restrict access to the PCP linux_sockets PMDA and monitor for suspicious activity related to the network.persocket.filter metric. Follow updates from the vendor for patch releases.