CVE-2026-16661: Power System Integer Overflow
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW1060.81(1060_184) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW1110.31(1110_134) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW1110.31(1110_155) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW1120.01(1120_190) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW950.H3(950_230) - Upgrade
Upgrade
IBM Power Systems Firmware (FSP/Service Processor)to a version that resolves this vulnerability.Patch FW1060.81(1060_191)
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires authenticated service-level access to the Flexible Service Processor (FSP). The issue is therefore relevant to environments where an attacker or unauthorized administrator can obtain that level of FSP access.
What is the potential impact after successful exploitation?
An attacker can execute arbitrary code in the host firmware runtime and gain full control of the managed system. This can affect the confidentiality, integrity, and availability of that system.
Which firmware releases are identified as affected?
Affected releases are FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; and FW950.00 through FW950.H2.
How can I determine whether my system is exposed?
Identify the Power Systems Firmware release in use and compare it with the listed affected release ranges. Also determine which accounts or administrators have authenticated service-level access to the FSP, since that access is required for exploitation.