Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemon

Impact

A crafted PDU sent during normal PDU processing or SASL negotiation drives a signed integer overflow in __pmGetPDU(), after which the affected daemon never reads another packet correctly - it is permanently blinded until restarted. On a GPU fleet PCP is frequently the metrics collector of record for node health, thermals and per-job resource accounting, and it is the backend behind Red Hat's performance tooling on RHEL and OpenShift nodes. Losing it does not stop GPU workloads, but it silently removes the telemetry an operator uses to notice a wedged node, a throttling GPU, or a job that has stopped making progress. Unauthenticated and remote, so any host that can reach pmcd's port can take collection down and keep it down.

Who can reach it

Anyone with network reach to a PCP daemon's listening port - no authentication required; the overflow can be triggered before or during SASL negotiation.

What to do

Update the pcp packages from the Red Hat errata (RHSA-2026:55560, RHSA-2026:55617, RHSA-2026:55740) and restart pmcd and any other affected PCP daemons; a wedged daemon also needs a restart to recover, workloads on the node are not disturbed. Until patched, restrict pmcd to the management network with a firewall rule rather than leaving it reachable from tenant networks.

References