CVE-2026-17042: IBM Power Systems Firmware DoS Vulnerability

CVE-2026-17042 Overview

CVE-2026-17042 is an out-of-bounds read vulnerability [CWE-125] in IBM Power Systems host firmware. The flaw resides in the NVRAM parsing logic used during the host firmware boot stage on OpenPOWER systems. An attacker with root access to a guest partition can write a malformed NVRAM image that crashes the host firmware and may trigger memory corruption. Recovery requires operator intervention to clear NVRAM through the service processor. Systems running PowerVM are not affected by this issue.

Critical Impact
A crafted NVRAM image from a guest partition can crash the host firmware boot stage, causing a persistent denial of service on the managed OpenPOWER system until NVRAM is manually cleared.

Affected Products

IBM Power Systems Firmware FW950.00 through FW950.H2
IBM Power Systems Firmware OP940.00 through OP940.a1 (Power9)
IBM Power Systems Firmware OP940.00 through OP940.81 (Power HMC)

Discovery Timeline

2026-08-19 - CVE-2026-17042 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17042

Vulnerability Analysis

The vulnerability resides in the host firmware component responsible for parsing Non-Volatile Random Access Memory (NVRAM) content during boot. Under normal operation, NVRAM stores configuration data that the firmware reads and validates on startup. The parser fails to properly enforce bounds when handling NVRAM entries. An attacker who controls a guest partition with root privileges can write a crafted NVRAM image that triggers the parser to read outside expected buffer boundaries.

The malformed data persists across reboots because NVRAM is non-volatile. Each subsequent boot re-reads the corrupt image, causing the host firmware to crash again. The condition remains until an operator clears NVRAM through the service processor. This escalation from guest partition to host firmware crosses a trust boundary, reflected in the changed scope of the vulnerability.

Root Cause

The defect is classified as CWE-125 (Out-of-bounds Read). The NVRAM parser in the affected firmware releases does not validate structure lengths or offsets before dereferencing memory during the boot stage. This allows attacker-controlled data written to NVRAM to steer the parser past valid buffer boundaries, producing a crash and potential memory corruption within the firmware environment.

Attack Vector

Exploitation requires local access with root privileges on a guest partition of an OpenPOWER system. The attacker writes a specially crafted NVRAM image using standard guest OS interfaces available to root. On the next host firmware boot cycle, the parser processes the malicious image and crashes. The vulnerability affects integrity and availability of the managed system but does not expose confidential data. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17042

Indicators of Compromise

Repeated host firmware boot failures on OpenPOWER systems following guest partition activity
Service processor logs indicating NVRAM parse errors or firmware boot stage crashes
Unexpected NVRAM write operations originating from a guest partition with root context

Detection Strategies

Monitor service processor and Hardware Management Console (HMC) event logs for firmware boot faults referencing NVRAM parsing
Audit root-level activity on guest partitions for unusual writes to NVRAM devices or interfaces
Correlate guest partition administrative actions with subsequent host boot anomalies

Monitoring Recommendations

Baseline expected NVRAM update patterns and alert on deviations, especially writes preceding a reboot
Forward HMC and service processor telemetry to a centralized logging platform for retention and correlation
Track firmware version inventories against IBM's fixed release list to identify systems still exposed

How to Mitigate CVE-2026-17042

Immediate Actions Required

Identify all OpenPOWER systems running FW950 or OP940 firmware in the affected ranges
Restrict and audit root access on guest partitions to reduce the attack surface
Prepare service processor procedures for clearing NVRAM in case of firmware boot failure

Patch Information

Apply the firmware updates published by IBM. Consult the IBM Support Page for the fixed firmware levels covering FW950 and OP940 releases and apply them through the standard HMC or service processor update workflow. PowerVM-based systems do not require action for this issue.

Workarounds

Limit guest partition root credentials to trusted administrators and enforce strong authentication controls
Where feasible, migrate affected workloads to PowerVM-based systems, which are not impacted
Maintain documented recovery steps to clear NVRAM via the service processor if a crash occurs