CVE-2026-17091: Power System Integer Overflow
IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system.
Other sources
Power Systems Firmware is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1060.81(1060_184) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1110.31(1110_134) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1110.31(1110_155) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1120.01(1120_190) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW950.H3(950_230) - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in FW1060.81(1060_191)
Event History
Frequently Asked Questions
Who can exploit this issue, and what level of access is required?
An attacker needs root access to a guest partition and must be able to issue a specially crafted PowerVM hypervisor call. The provided information does not indicate that unprivileged guest users or remote unauthenticated attackers can exploit it.
What could exploitation do to the managed system?
Exploitation can inject an arbitrary amount of data into hypervisor or partition memory, causing memory corruption or a crash. A crash can trigger a full platform re-IPL that terminates all hosted partitions; repeated exploitation may create a sustained availability impact.
Which PowerVM Hypervisor firmware releases are affected?
Affected releases are FW1120.00; FW1110.00 through FW1110.30; FW1060.00 through FW1060.80; and FW950.00 through FW950.H2.
Does the hypervisor recover after a crash?
The PowerVM hypervisor restarts automatically after a crash. However, the restart involves a full platform re-IPL and terminates all hosted partitions, and repeated exploitation can continue to disrupt availability.