CVE-2026-17413: IBM Power System S1122 Firmware DOS Flaw

CVE-2026-17413 Overview

CVE-2026-17413 is a denial of service vulnerability in the IBM PowerVM Hypervisor affecting the Run-Time Abstraction Services (RTAS) firmware-to-OS interface. The flaw stems from improper validation of array indices [CWE-129] within partition firmware. An attacker with administrator (root) access to a logical partition can send a specially crafted request to partition firmware. The request causes the partition to crash and become unavailable. Other logical partitions on the same managed system are not impacted. The vulnerability affects firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3.

Critical Impact
Local root-level attackers can trigger an availability loss of the targeted logical partition on IBM Power Systems running vulnerable PowerVM firmware.

Affected Products

IBM PowerVM Hypervisor firmware FW1120.00 through FW1120.01
IBM PowerVM Hypervisor firmware FW1110.00 through FW1110.31 and FW1060.00 through FW1060.81
IBM PowerVM Hypervisor firmware FW950.00 through FW950.H3 running on Power Systems including E1080, E1180, E1050, E1150, E950, E980, S1012/S1014/S1022/S1024, S922/S924, L1022/L1024, and L1122/L1124

Discovery Timeline

2026-09-24 - CVE-2026-17413 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-17413

Vulnerability Analysis

The vulnerability resides in the RTAS interface, which provides a standardized call layer between operating systems running inside PowerVM logical partitions (LPARs) and the underlying partition firmware. When an authenticated administrator inside a guest LPAR invokes an RTAS call with a crafted parameter, firmware fails to properly validate an array index before use. The resulting out-of-bounds access causes the partition firmware to fault, which terminates the LPAR.

Because PowerVM enforces strong isolation across partitions, the crash is contained within the targeted LPAR. Workloads running in other partitions on the same managed system continue to execute. The impact is a loss of availability for the affected partition and any applications hosted on it.

Root Cause

The root cause is improper validation of an array index [CWE-129] in the RTAS firmware-to-OS interface. The firmware uses attacker-controllable input as an index into an internal structure without first confirming the value is within the valid range. Passing an out-of-range index drives firmware execution into an invalid state and crashes the partition.

Attack Vector

Exploitation requires local access to a logical partition and administrator-level privileges within the guest operating system. The attacker issues a specially crafted RTAS request through the standard OS-to-firmware interface. No user interaction is required and the attack does not cross partition boundaries. The outcome is a reliable crash of the targeted LPAR.

No public proof-of-concept exploit code is available in the referenced advisory, so technical specifics of the crafted request are not published. Administrators should treat the IBM security bulletin as the authoritative reference.

Detection Methods for CVE-2026-17413

Indicators of Compromise

Unexpected termination or reboot of a single LPAR while sibling partitions on the same managed system remain healthy.
RTAS-related error entries in the Hardware Management Console (HMC) service event log or the partition's platform error log.
Operating system crash dumps referencing RTAS calls immediately prior to partition loss.

Detection Strategies

Correlate HMC serviceable events with guest OS uptime to identify partitions that crash without a corresponding workload or hardware fault.
Baseline the firmware level reported by lsmcode or the HMC against the fixed levels listed in the IBM advisory to flag unpatched systems.
Review audit logs for root-level sessions on LPARs preceding unexplained partition failures.

Monitoring Recommendations

Forward HMC and PowerVM platform event logs to a centralized log platform for availability monitoring and alerting on repeated LPAR crashes.
Alert on administrative logins to AIX, IBM i, and Linux guests that are followed within a short window by partition termination events.
Track firmware inventory as a compliance control so unpatched FW1120, FW1110, FW1060, and FW950 systems are visible to the operations team.

How to Mitigate CVE-2026-17413

Immediate Actions Required

Inventory all IBM Power Systems and identify managed systems running firmware in the FW1120, FW1110, FW1060, or FW950 families.
Apply the fixed PowerVM Hypervisor firmware level documented in the IBM security bulletin as soon as a maintenance window allows.
Restrict and audit root-level access inside LPARs, since exploitation requires administrator privileges within the guest.

Patch Information

IBM has published a security bulletin and firmware updates addressing CVE-2026-17413. Refer to the IBM Support Page for the exact remediated firmware levels per machine type and model, along with update instructions through the HMC.

Workarounds

Enforce least privilege inside each LPAR so that only trusted administrators hold root or equivalent privileges on AIX, IBM i, and Linux guests.
Isolate non-production workloads that cannot be patched immediately onto managed systems separate from critical production LPARs to limit availability impact.
Increase monitoring of RTAS-related platform events on unpatched systems until firmware updates are applied.

bash

# Check installed PowerVM firmware level from AIX
lsmcode -A

# From the HMC, list managed system firmware levels
lssyscfg -r sys -F name,activated_lic_level,deferred_lic_level