CVE-2026-17422: Vulnerabilities in IBM AIX and PowerVM VIOS
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM PowerVM VIOS 4.1.1to a version that resolves this vulnerability.Fixed in 4.1.1.30Patch IJ5956408/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.0to a version that resolves this vulnerability.Fixed in 4.1.0.50Patch IJ5956508/14/2026 - Upgrade
Upgrade
IBM PowerVM VIOS 4.1.2to a version that resolves this vulnerability.Fixed in 4.1.2.20Patch IJ5956308/14/2026 - Compensating control
If applying these patches using nimsh secure, follow the special steps required because the protocol between master and client is updated to be more secure.
- Operational
For the SP/FP update on AIX/VIOS, perform an LPAR reboot to complete the SP/FP update (A reboot is required to complete the SP/FP update). On AIX, Live Update can be used to avoid a reboot.
- Operational
For VIOS 4.1.0 and VIOS 4.1.1: after applying the 4.1.0.50 or 4.1.1.30 FPs, perform the additional steps required to migrate to the latest Postgres15 (post-update steps required after applying the 4.1.1.30 or 4.1.0.50 FPs).
Event History
Frequently Asked Questions
Is IBM PowerVM VIOS in scope as well as IBM AIX?
Yes. The affected software list includes both IBM AIX and IBM PowerVM VIOS.
Does the available information indicate a remote attack vector?
No. The vulnerability is described as allowing a local attacker to execute arbitrary code; no remote attack vector is provided.