CVE-2026-17028: Power System Out-of-bounds Read
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.
Other sources
Power Systems Firmware is affected by a vulnerability in partition firmware during network boot. An unauthenticated attacker with access to the same network as a partition undergoing iSCSI SAN network boot can prevent that partition from completing its boot sequence. Other partitions and the managed system are not affected. Only partitions actively performing an iSCSI SAN network boot are affected, resulting in an availability impact.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1060.81(1060_184) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1060.81(1060_191) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1110.31(1110_134) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1120.01(1120_167) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1110.31(1110_155) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW1120.01(1120_190) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch FW950.H3(950_230)
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Only partitions actively performing an iSCSI SAN network boot are affected. Other partitions and the managed system are not affected.
What does an attacker need to exploit the vulnerability?
An attacker does not need authentication, but must have access to the same network as the partition while it is undergoing iSCSI SAN network boot.
What is the expected impact of exploitation?
An attacker can prevent the affected partition from completing its boot sequence. The impact is limited to availability; no confidentiality or integrity impact is described.
How can I determine whether a partition is affected?
Determine whether the partition is actively using iSCSI SAN network boot and whether its firmware is FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, or FW950.00 through FW950.H2.