This vulnerability involves a signed integer overflow in the PCP __pmGetPDU() function within Red Hat Enterprise Linux 10. Exploitation occurs via specially crafted network packets during PDU processing or SASL negotiation, which causes the affected daemon (pmlogger or pmcd) to become permanently blinded, resulting in a total denial of service for subsequent packet reads. While these services are typically bound to the loopback interface by default, remote exploitation is possible if the default binding configuration is altered or if the PMLOGGER_LOCAL environment variable is unset for pmlogger. The vulnerability is classified as an important denial of service issue due to resource exhaustion. Red Hat advisory recommends restricting network exposure of these services and applying firewall rules if remote access is unnecessary. No official patch or remediation level has been published as of the advisory date.

An unauthenticated remote attacker can cause a permanent denial of service by sending crafted requests to the pmlogger or pmcd services, exhausting resources and blinding the daemon to further packets. This results in service unavailability. The confidentiality and integrity of the system are not impacted. The default configuration limits exposure by binding these services to the loopback interface, reducing the risk of remote exploitation unless configurations are changed.

Red Hat advises ensuring that the PCP services pmlogger and pmcd are not exposed to untrusted networks. By default, these services listen only on the loopback interface, which prevents remote exploitation. If the default network bindings have been altered, revert them to restrict access to localhost. For pmlogger, ensure the PMLOGGER_LOCAL environment variable is set. If remote access is not required, implement firewall rules to block external connections to TCP ports 4330 (pmlogger) and 44321 (pmcd). Restart affected PCP services after making configuration changes. No official patch or fix is currently available; patch status is not yet confirmed — check the Red Hat advisory for updates.