CVE-2026-16829: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade
IBM PowerVM VIOSto a version that resolves this vulnerability.Fixed in 4.1.2.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956508 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956408 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956308 - Compensating control
If using VIOS 4.1.0.50 or 4.1.1.30, perform the additional required steps to migrate to the latest Postgres15 after applying the FP(s).
- Operational
An LPAR reboot is required to complete the SP/FP update.
- Operational
If applying these patches using nimsh secure, take the special steps because the protocol between master and client is updated to be more secure (per IBM instructions referenced in the provided material).
- Operational
On AIX, Live Update can be used to avoid a reboot when applying the SP/FP remediation levels.
Event History
Frequently Asked Questions
Which IBM products are identified as affected?
The affected software listed is IBM AIX and IBM PowerVM VIOS.
Does exploitation require local access?
The issue is described as exploitable by a remote attacker. The available information does not state any authentication or other access prerequisites.