CVE-2026-16817: Vulnerabilities in IBM AIX and PowerVM VIOS
AIX could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.
Other sources
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade
PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956608 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956508 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956408 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ59563 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956308 - Operational
For AIX, an LPAR reboot is required to complete the SP/FP update (including after applying the AIX/VIOS remediation levels).
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs.
Event History
Frequently Asked Questions
What is the impact of successful exploitation?
A remote attacker could cause a denial of service by triggering a NULL pointer dereference.
Which products are identified as affected?
The affected products listed are IBM AIX and IBM PowerVM VIOS.
Is authentication or any specific network service required for exploitation?
The available information only states that the attacker is remote. It does not specify authentication requirements, the affected service, or the conditions needed to trigger the issue.