CVE-2026-17413: This Power System update is being released to address
IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected.
Other sources
Power Systems Firmware is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1060.82(1060_189) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1110.32(1110_138) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1120.02(1120_171) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1110.32(1110_160) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1120.02(1120_195) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW950.H4(950_236) - Upgrade
Upgrade
IBM PowerVM Hypervisorto a version that resolves this vulnerability.Fixed in FW1060.82(1060_199)
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs administrator-level (root) access to a logical partition (LPAR) on an affected IBM PowerVM Hypervisor or Power Systems Firmware level. It is therefore primarily relevant where root access within an LPAR could be obtained or is not fully trusted.
What is the impact on other logical partitions sharing the managed system?
The crafted RTAS request can crash the targeted partition and make it unavailable. Other partitions on the same managed system are not affected.
Which firmware levels should be checked?
Check for IBM PowerVM Hypervisor firmware in the FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, or FW950.00 through FW950.H3 ranges.