A file descriptor leak vulnerability in the Red Hat Performance Co-Pilot (PCP) linux_sockets module creates an unauthorized communication path, risking system security.

This flaw (CWE-403) involves the exposure of a file descriptor to an unintended control sphere. An authenticated attacker (PR:L) can exploit this to interact with unsecured internal connections, potentially leading to unauthorized data access or service disruption.

Exploitation of this vulnerability could lead to the exposure of sensitive internal data or unauthorized interaction with background services. Given the CVSS score of 8.8, this represents a significant risk to the integrity and confidentiality of RHEL and OpenShift environments, particularly in multi-tenant or containerized deployments.

Immediate Action: Monitor the Red Hat security advisory page for this specific CVE and apply the relevant package updates for PCP as soon as they are released for your specific RHEL version.

Proactive Monitoring: Review security logs for anomalous socket connections or unexpected interactions with the Performance Co-Pilot service.

Compensating Controls: If immediate patching is not possible, disable the PCP linux_sockets module or restrict access to the Performance Co-Pilot service to authorized users only.

Public Exploit Available: Unknown.

Administrators should treat this as a high-priority update due to the broad impact across multiple RHEL versions. Ensure that your patch management cycle includes the latest updates from Red Hat to remediate the file descriptor leak in the PCP module.