CVE-2026-17097: IBM PowerVM Hypervisor DoS Vulnerability

CVE-2026-17097 Overview

CVE-2026-17097 is a high-severity vulnerability in the IBM PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call. The call causes a virtual processor to become permanently unresponsive. Restoring normal operation requires a full platform re-IPL (Initial Program Load). In some cases, the guest may also inject a small amount of data into hypervisor or partition memory, with no attacker control over the target location. Affected firmware levels include FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The weakness is classified as [CWE-129] Improper Validation of Array Index.

Critical Impact
Successful exploitation renders a virtual processor unresponsive and can corrupt hypervisor or partition memory, requiring a full platform re-IPL to recover the managed system.

Affected Products

IBM PowerVM Hypervisor FW1120.00
IBM PowerVM Hypervisor FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80
IBM PowerVM Hypervisor FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-17097 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17097

Vulnerability Analysis

The vulnerability resides in the PowerVM hypervisor call (hcall) interface. Guest partitions invoke hcalls to request privileged services from the hypervisor. An attacker with root inside a guest partition can construct a malformed hcall that the hypervisor fails to validate correctly. Processing the malformed call places a virtual processor into a state from which it cannot recover. The affected virtual processor stops servicing work until the entire platform is re-IPLed. The defect can also cause the guest to write a small quantity of data into hypervisor or partition memory. The attacker cannot select the destination address, but the write breaches the guest-to-hypervisor trust boundary and can corrupt shared platform state.

Root Cause

The root cause is improper validation of an array index within the hypervisor call handling path, tracked as [CWE-129]. The hypervisor accepts an index-bearing parameter from the guest without adequately bounding it before use. Downstream logic then operates on an out-of-range element, wedging the virtual processor and permitting an uncontrolled memory write in some paths.

Attack Vector

Exploitation requires local access and elevated privileges. The attacker must already hold root within a guest logical partition (LPAR) running on the vulnerable PowerVM system. From there, the attacker issues the crafted hypervisor call directly. No user interaction is required, and the scope changes because impact crosses from the guest into the hypervisor and other partitions on the managed system.

No public proof-of-concept or exploit code is available. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17097

Indicators of Compromise

Virtual processors reported as unresponsive or stuck by the Hardware Management Console (HMC) with no corresponding workload cause.
Unexpected requirement for a full platform re-IPL following guest activity from a privileged user.
Hypervisor error log entries referencing malformed or invalid hcall parameters originating from a specific LPAR.

Detection Strategies

Correlate HMC, Flexible Service Processor (FSP), and partition serviceable event logs to identify anomalous hcall failures preceding virtual processor hangs.
Baseline hcall usage per partition and alert on partitions issuing unusual or previously unseen hypervisor call patterns.
Monitor privileged shell activity inside guest LPARs for programs that directly invoke plpar_hcall or equivalent low-level interfaces.

Monitoring Recommendations

Forward HMC, VIOS, and partition system logs to a centralized analytics platform for cross-partition correlation.
Track platform availability metrics including unplanned re-IPLs and virtual processor stalls per managed system.
Audit root-level access on all guest partitions and alert on new administrative sessions from unexpected sources.

How to Mitigate CVE-2026-17097

Immediate Actions Required

Inventory all PowerVM managed systems and identify firmware levels matching the affected ranges FW1120, FW1110, FW1060, and FW950.
Apply the IBM firmware fix documented on the IBM Support Page at the next available maintenance window.
Restrict and audit root access within guest LPARs, since exploitation requires local privileged access inside a partition.

Patch Information

IBM has published remediation guidance and fixed firmware levels for CVE-2026-17097. Consult the IBM Support Page for the specific service pack levels that address FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2. Firmware updates require a scheduled platform activation and should be planned with the system administrator responsible for the managed system.

Workarounds

Limit guest partition root credentials to trusted administrators and enforce multi-factor authentication for privileged access.
Isolate untrusted or multi-tenant workloads onto separate managed systems until firmware is updated to reduce blast radius from a re-IPL.
Ensure current backups and tested recovery procedures exist for all LPARs, given that recovery requires a full platform re-IPL.

bash

# Query current PowerVM system firmware level from the HMC
lssyscfg -r sys -F name,type_model,serial_num,state,sys_firmware

# List installed firmware levels for a managed system
lslic -m <managed_system_name> -t sys