CVE-2026-17255: IBM i ICMPv6 DOS Vulnerability

CVE-2026-17255 Overview

CVE-2026-17255 is a denial of service vulnerability affecting IBM i operating system versions 7.3, 7.4, 7.5, and 7.6. The flaw stems from improper validation of the prefix length field in ICMPv6 Router Advertisement messages. A remote unauthenticated attacker can send crafted ICMPv6 packets to trigger the condition and disrupt system availability. The vulnerability is tracked under CWE-787 (Out-of-Bounds Write) and requires no user interaction or privileges to exploit. IBM has published a support advisory documenting the affected releases and remediation guidance.

Critical Impact
Remote attackers can trigger a denial of service on IBM i systems by sending malformed ICMPv6 Router Advertisements over the network, with no authentication required.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-17255 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-17255

Vulnerability Analysis

The vulnerability resides in the IBM i network stack's handling of ICMPv6 Router Advertisement (RA) messages. Router Advertisements are part of the IPv6 Neighbor Discovery Protocol and communicate network prefix information to hosts on a link. Each Prefix Information Option in an RA includes a prefix length field indicating how many bits of the address represent the network portion.

IBM i fails to properly validate this prefix length value before processing. A malformed or out-of-range prefix length can drive an out-of-bounds write condition ([CWE-787]) inside the affected code path. The result is an availability impact that halts or destabilizes the affected networking components.

Root Cause

The root cause is missing or insufficient bounds checking on the prefix length field within ICMPv6 Router Advertisement processing. When the value exceeds expected limits, downstream memory operations write beyond intended buffer boundaries, corrupting adjacent memory or crashing the handler.

Attack Vector

Exploitation requires network adjacency to send ICMPv6 traffic that the target IBM i host will accept. Because ICMPv6 Router Advertisements originate from link-local sources, an attacker typically needs a foothold on the same broadcast domain or a compromised on-path device. No authentication or user interaction is required. The impact is limited to availability; confidentiality and integrity are not affected.

No public proof-of-concept exploit code is available for this vulnerability. Refer to the IBM Support Document for authoritative technical details.

Detection Methods for CVE-2026-17255

Indicators of Compromise

Unexpected IBM i TCP/IP stack restarts or IPv6 interface failures coinciding with inbound ICMPv6 traffic.
Anomalous volumes of ICMPv6 Router Advertisement messages, particularly with unusual or out-of-range prefix length values.
Loss of network connectivity on IPv6-enabled IBM i partitions without corresponding operator actions.

Detection Strategies

Inspect ICMPv6 Type 134 (Router Advertisement) messages at network sensors and flag Prefix Information Options where the prefix length exceeds 128.
Correlate IBM i system availability events with IPv6 neighbor discovery traffic captured on the local segment.
Enable IPv6 Router Advertisement Guard (RA-Guard) on switches to identify unauthorized RA sources.

Monitoring Recommendations

Forward IBM i QSYSOPR and network stack messages to a centralized SIEM for correlation with packet telemetry.
Baseline legitimate IPv6 router sources and alert on RAs from unexpected MAC or link-local addresses.
Monitor for repeated ICMPv6 parsing errors reported by the IBM i communications subsystem.

How to Mitigate CVE-2026-17255

Immediate Actions Required

Apply the IBM PTFs referenced in the IBM Support Document for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory all IBM i partitions with IPv6 enabled and prioritize patching those exposed to untrusted network segments.
Enable RA-Guard on access switches to block unauthorized ICMPv6 Router Advertisements.

Patch Information

IBM has published remediation guidance in support document node/7286093. Administrators should download and apply the appropriate Group PTF or individual PTFs for their IBM i release level. Verify PTF installation using DSPPTF and confirm the affected TCP/IP components are updated.

Workarounds

Disable IPv6 on IBM i partitions that do not require it using the CFGTCP menu to remove IPv6 interfaces.
Restrict ICMPv6 Router Advertisement traffic at layer 2 using switch port RA-Guard or VLAN segmentation.
Place IBM i systems on isolated network segments where only trusted IPv6 routers can send RAs.

bash

# Configuration example: verify PTF status and inspect IPv6 interfaces on IBM i
DSPPTF LICPGM(5770SS1)
NETSTAT OPTION(*IFC) ADDRESSFORMAT(*IP6)
CFGTCP
# Select option 1 to work with TCP/IP interfaces and remove unused IPv6 interfaces