CVE-2026-17028: IBM PowerVM Hypervisor DoS Vulnerability

CVE-2026-17028 Overview

CVE-2026-17028 affects IBM PowerVM Hypervisor partition firmware during iSCSI SAN network boot. An unauthenticated attacker on the same network as a booting partition can prevent that partition from completing its boot sequence. The vulnerability is classified as an out-of-bounds read [CWE-125] and results in an availability impact on the targeted partition. Other partitions and the managed system remain unaffected. Only partitions actively performing an iSCSI SAN network boot are exposed to the flaw.

Critical Impact
An adjacent-network attacker can disrupt iSCSI SAN network boot operations on IBM PowerVM partitions, preventing successful partition startup and causing availability loss for the affected workload.

Affected Products

IBM PowerVM Hypervisor FW1120.00
IBM PowerVM Hypervisor FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80
IBM PowerVM Hypervisor FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-17028 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17028

Vulnerability Analysis

The flaw resides in IBM PowerVM Hypervisor partition firmware code that handles the iSCSI SAN network boot process. During boot, the partition firmware processes iSCSI protocol data received over the network to load its boot image. A malformed or malicious network response triggers an out-of-bounds read condition within the firmware boot logic. This out-of-bounds read disrupts the boot sequence and prevents the partition from completing initialization. The attacker does not need credentials or user interaction on the target system. The impact is limited to partitions actively performing an iSCSI SAN boot at the time of the attack.

Root Cause

The root cause is improper bounds validation in the partition firmware's iSCSI network boot handler, tracked as [CWE-125] Out-of-Bounds Read. The firmware reads beyond the intended memory buffer when parsing attacker-supplied network data, halting the boot flow.

Attack Vector

The attack vector is Adjacent Network. An unauthenticated attacker must have access to the same network segment as the PowerVM partition undergoing an iSCSI SAN network boot. The attacker sends crafted iSCSI traffic that triggers the out-of-bounds read in the partition firmware. Successful exploitation prevents the target partition from completing boot but does not compromise confidentiality or integrity, nor affect other partitions or the managed system.

No public exploit code is available for CVE-2026-17028. See the IBM Support Page for authoritative technical details.

Detection Methods for CVE-2026-17028

Indicators of Compromise

Partition boot failures or hangs during iSCSI SAN network boot phases across one or more logical partitions (LPARs).
Unexpected or malformed iSCSI Protocol Data Units (PDUs) observed on the boot VLAN targeting partitions in the boot state.
Hardware Management Console (HMC) events indicating repeated failed boot attempts on partitions configured for iSCSI SAN boot.

Detection Strategies

Monitor HMC and Flexible Service Processor (FSP) logs for partition firmware errors correlated with iSCSI boot attempts.
Inspect network flows on iSCSI boot VLANs for unauthorized initiators or unexpected traffic sources during partition startup windows.
Correlate partition boot state transitions with network capture data to identify attacker-injected iSCSI responses.

Monitoring Recommendations

Enable detailed logging on iSCSI targets and network switches carrying SAN boot traffic.
Alert on multiple consecutive iSCSI boot failures for the same partition within a short window.
Track additions of unauthorized MAC or IP addresses to the boot network segment.

How to Mitigate CVE-2026-17028

Immediate Actions Required

Apply the IBM firmware updates referenced in the IBM Support Page to all affected PowerVM Hypervisor levels: FW1120, FW1110, FW1060, and FW950.
Restrict access to iSCSI SAN boot network segments to authorized initiators, targets, and management systems only.
Schedule partition reboots and iSCSI boot operations during controlled maintenance windows with active network monitoring.

Patch Information

IBM has released firmware updates addressing CVE-2026-17028 across the affected PowerVM Hypervisor branches. Consult the IBM Support Page for the fixed firmware levels and installation instructions specific to each hypervisor version.

Workarounds

Isolate iSCSI SAN boot traffic on a dedicated VLAN with strict access control lists limiting Layer 2 reachability.
Use switch port security and MAC filtering to block unauthorized devices from joining the boot network segment.
Where feasible, boot partitions from local storage or Fibre Channel SAN until firmware patches are applied.

bash

# Configuration example: restrict iSCSI boot VLAN on a managed switch
vlan 200
 name iscsi-boot
interface range GigabitEthernet1/0/1-8
 switchport mode access
 switchport access vlan 200
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 ip access-group iscsi-boot-acl in