CVE-2026-17091

Analyzed Analyzed - Analysis Complete

Memory Corruption in IBM PowerVM Hypervisor

Publication date: 2026-08-19

Last updated on: 2026-08-25

Assigner: IBM Corporation

Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-25

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-17091

EUVD

EUVD-2026-62868

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	power_system_s1122_(9824-22a)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_s1122_(9824-22a)_firmware	fw1120.00
ibm	power_system_s1124_(9824-42a)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_s1124_(9824-42a)_firmware	fw1120.00
ibm	power_system_s1122s_(9824-22b)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_s1122s_(9824-22b)_firmware	fw1120.00
ibm	power_system_s1114_(9824-41b)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_s1114_(9824-41b)_firmware	fw1120.00
ibm	power_system_l1122_(9856-22h)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_l1122_(9856-22h)_firmware	fw1120.00
ibm	power_system_l1124_(9856-42h)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_l1124_(9856-42h)_firmware	fw1120.00
ibm	power_system_e1150_(9043-mru)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_e1150_(9043-mru)_firmware	fw1120.00
ibm	power_system_s1112_(9242-21b)_firmware	fw1120.00
ibm	power_system_s1112_(9242-21t)_firmware	fw1120.00
ibm	power_system_e1080_(9080-hex)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_s1022_(9105-22a)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_s1024_(9105-42a)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_s1022s_(9105-22b)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_s1014_(9105-41b)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_l1022_(9786-22h)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_l1024_(9786-42h)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_e1050_(9043-mrx)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_s1012_(9028-21b)_firmware	From fw1060.00 (inc) to fw1060.81 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	From fw1110.00 (inc) to fw1110.31 (exc)
ibm	power_system_e1180_(9080-heu)_firmware	fw1120.00
ibm	power_system_s922_(9009-22g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_h922_(9223-22s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_s914_(9009-41g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_s924_(9009-42g)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_h924_(9223-42s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_e950_(9040-mr9)_firmware	From fw950.00 (inc) to fw950.h3 (exc)
ibm	power_system_e980_(9080-m9s)_firmware	From fw950.00 (inc) to fw950.h3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

CVE-2026-17091 is a flaw in IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. It involves a vulnerability in the hypervisor call interface where an attacker with root access to a guest partition can send a specially crafted hypervisor call to inject excessive data into hypervisor or partition memory.

Detection Guidance

Detection primarily involves checking the firmware version of your PowerVM Hypervisor. Compare your current firmware version against the affected versions listed: FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. Use IBM tools or commands like 'lsmcode' on AIX or 'lsfware' on Linux to verify the firmware version.

Impact Analysis

Exploitation can cause a system crash requiring a full platform restart, terminating all hosted partitions. It may also lead to memory corruption in the hypervisor or partition. Repeated attacks could result in sustained availability issues. The impact includes both integrity and availability problems for the managed system.

Compliance Impact

This vulnerability primarily impacts system integrity and availability, which are critical for compliance with standards like GDPR and HIPAA. A crash or memory corruption could lead to unauthorized data access or loss, violating GDPR's data integrity and availability requirements. For HIPAA, it may compromise the confidentiality and availability of protected health information if exploited.

Mitigation Strategies

Immediately update the PowerVM Hypervisor firmware to the latest version provided by IBM for your specific Power Systems model. Since no workarounds exist, applying the official firmware patches is critical to prevent exploitation. Access IBM Fix Central to download and install the appropriate firmware update for your hardware.

Hi! I’m here to help you understand CVE-2026-17091. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70