CVE-2026-17097

Received Received - Intake

PowerVM Hypervisor Call Denial of Service

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: IBM Corporation

Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-17097

EUVD

EUVD-2026-62870

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	powervm_hypervisor	From FW1110.00 (inc) to FW950.H2 (inc)
ibm	powervm_hypervisor	From FW1110.00 (inc) to FW1110.30 (inc)
ibm	powervm_hypervisor	From FW1060.00 (inc) to FW1060.80 (inc)
ibm	powervm_hypervisor	From FW950.00 (inc) to FW950.H2 (inc)
ibm	powervm_hypervisor	FW1120.00

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

CVE-2026-17097 is a flaw in IBM PowerVM Hypervisor firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. An attacker with root access to a guest partition can send a malicious hypervisor call that may crash a virtual processor, requiring a full system restart to recover. In rare cases, it might also allow uncontrolled data injection into hypervisor or partition memory.

Detection Guidance

Detection primarily involves checking firmware versions against affected ranges. Use IBM's firmware management tools or commands like 'lsmcode -r' on AIX/Linux to list installed firmware versions. Compare against affected versions: FW1120.00, FW1110.00–FW1110.30, FW1060.00–FW1060.80, FW950.00–FW950.H2.

Impact Analysis

If exploited, this vulnerability can cause system downtime as a virtual processor becomes unresponsive, requiring a full platform re-IPL. It may also lead to data corruption or unauthorized memory access, affecting system integrity. The impact is limited to systems running affected PowerVM firmware versions.

Compliance Impact

This vulnerability primarily impacts integrity and availability of the managed system, which could lead to non-compliance with regulations like GDPR or HIPAA that require data integrity and system availability. Uncontrolled data injection into memory may also violate confidentiality requirements under these standards.

Mitigation Strategies

Install the latest firmware updates provided by IBM for your Power Systems model. Check IBM Fix Central for patches specific to Power 9, Power 10, or Power 11 systems. No workarounds exist; firmware updates are required to resolve the issue.

Hi! I’m here to help you understand CVE-2026-17097. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70