CVE-2026-16935: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PowerVM VIOS 4.1to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
PowerVM VIOS 4.1to a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956608 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956508 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956408 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ59563 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch IJ5956308 - Compensating control
If using nimsh secure to apply these VIOS/AIX patches, take the special steps required because the protocol between master and client is updated to be more secure (per the linked IBM instructions).
- Compensating control
On AIX, use Live Update to avoid a reboot when applying the SP/FP updates.
- Operational
Reboot the LPAR is required to complete the SP/FP update.
Event History
Frequently Asked Questions
Which systems should be assessed for exposure?
Assess systems running IBM AIX or IBM PowerVM VIOS.
What access does an attacker need to exploit this issue?
The issue is described as exploitable by a local attacker, who could gain elevated privileges through a race condition.