CVE-2026-17195: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to an out-of-bounds write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AIX 7.2to a version that resolves this vulnerability.Patch SPKEY7.2.5 - Upgrade
Upgrade
PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50 - Upgrade
Upgrade
PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30 - Upgrade
Upgrade
PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20 - Compensating control
If using NIMSH secure to apply these patches, take the special steps noted in the article because the master-client protocol is updated to be more secure.
- Operational
Reboot the LPAR is required to complete the SP/FP update for AIX/VIOS.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1, after applying the 4.1.0.50 or 4.1.1.30 FPs, perform the additional steps required to migrate to the latest Postgres15.
Event History
Frequently Asked Questions
Who can exploit this issue?
A local attacker could exploit the out-of-bounds write to cause a denial of service. The provided information does not indicate that remote access alone is sufficient.
Which products are identified as affected?
The affected software listed is IBM AIX and IBM PowerVM VIOS.