CVE-2026-17091: IBM PowerVM Hypervisor DoS Vulnerability

CVE-2026-17091 Overview

CVE-2026-17091 affects the IBM PowerVM hypervisor call interface across multiple firmware releases. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject arbitrary data into hypervisor or partition memory. Successful exploitation causes either a full platform re-IPL that terminates all hosted partitions, or corruption of hypervisor and partition memory. The PowerVM hypervisor restarts automatically, but repeated exploitation produces a sustained availability impact on the managed system. The flaw is categorized under [CWE-190] Integer Overflow or Wraparound and impacts both integrity and availability of the managed system.

Critical Impact
A root-level attacker in a single guest partition can crash or corrupt the hypervisor, terminating every hosted partition on the managed system.

Affected Products

IBM PowerVM Hypervisor FW1120.00
IBM PowerVM Hypervisor FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80
IBM PowerVM Hypervisor FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-17091 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17091

Vulnerability Analysis

The vulnerability resides in the PowerVM hypervisor call (hcall) interface that guest partitions use to request privileged services from the hypervisor. A guest partition with root privileges can craft an hcall whose parameters trigger an integer overflow condition when the hypervisor processes the request. The overflow causes the hypervisor to accept an arbitrary amount of caller-supplied data, writing beyond intended boundaries into hypervisor or partition memory.

Because the scope changes from the guest partition to the entire managed system, a single compromised logical partition (LPAR) can affect every partition sharing the hypervisor. Outcomes range from immediate platform re-IPL — a full firmware reload that terminates all hosted partitions — to silent memory corruption that undermines integrity guarantees between partitions.

Root Cause

The defect is an integer overflow [CWE-190] in the validation logic of the hypervisor call interface. Length or size parameters supplied by the guest are not correctly bounded before being used to move data, allowing the calculated buffer size to wrap and bypass sanity checks. The subsequent copy operation writes attacker-controlled data into memory that belongs to the hypervisor or a neighboring partition.

Attack Vector

Exploitation requires local access — specifically, root-level code execution inside a guest partition running on the affected firmware. No user interaction is needed. The attacker issues a specially crafted hypervisor call with parameter values engineered to trigger the overflow. Refer to the IBM Security Advisory for the vendor's technical description and updated firmware levels.

Detection Methods for CVE-2026-17091

Indicators of Compromise

Unscheduled platform re-IPL events reported by the Hardware Management Console (HMC) or FSP service processor.
Simultaneous termination of all partitions on a managed system without an administrator-initiated action.
Hypervisor error logs referencing invalid hcall parameters, memory validation failures, or checkstop conditions.

Detection Strategies

Correlate HMC and service processor logs for repeated hypervisor restarts originating from the same managed system or LPAR.
Monitor partition-level audit logs for privilege escalation to root followed by anomalous hcall activity patterns.
Baseline normal hypervisor call rates per partition and alert on deviations that precede platform instability.

Monitoring Recommendations

Forward HMC, FSP, and AIX/Linux/IBM i partition logs into a central SIEM for cross-partition correlation.
Track firmware level inventory continuously to confirm every managed system is at a patched release.
Alert on any unexpected re-IPL event and treat repeated occurrences as a potential exploitation attempt rather than a hardware fault.

How to Mitigate CVE-2026-17091

Immediate Actions Required

Apply the IBM firmware updates referenced in the IBM Security Advisory to all Power systems running the affected FW950, FW1060, FW1110, or FW1120 streams.
Restrict and audit root access within guest partitions, since exploitation requires local root privileges in an LPAR.
Prioritize patching on managed systems that host multi-tenant or mixed-trust partitions, where a single compromised LPAR can impact unrelated workloads.

Patch Information

IBM has issued fixed firmware levels that address the integer overflow in the hypervisor call interface. Consult the IBM Security Advisory for the specific target firmware level corresponding to each affected stream (FW950, FW1060, FW1110, FW1120) and follow standard Power firmware update procedures via the HMC.

Workarounds

No vendor-supplied workaround eliminates the vulnerability; firmware update is the required remediation.
Reduce risk by tightening privileged access controls on guest partitions and separating high-value workloads onto managed systems with restricted administrative access until firmware is applied.
Ensure automated re-IPL recovery procedures and partition boot ordering are validated so availability impact is minimized if an incident occurs before patching completes.

bash

# Example: check current system firmware level on an HMC-managed Power server
lssyscfg -r sys -F name,type_model,serial_num,current_lic_lpar_proc_units,system_firmware