CVE-2026-17414: IBM PowerVM Hypervisor DoS Vulnerability

CVE-2026-17414 Overview

CVE-2026-17414 affects IBM PowerVM Hypervisor partition firmware during network boot operations. An unauthenticated attacker on the same network as a partition performing a network boot can disrupt the boot sequence. When operating system secure boot is disabled, which is the default configuration, the attacker can substitute the boot image and compromise everything subsequently loaded by that partition. The flaw is tracked under CWE-20: Improper Input Validation. Only partitions actively performing a network boot are affected; other partitions and the managed system remain unaffected.

Critical Impact
Adjacent-network attackers can hijack partition network boot, substitute the boot image, and compromise the operating system loaded on the target partition.

Affected Products

IBM PowerVM Hypervisor FW1120.00
IBM PowerVM Hypervisor FW1110.00 through FW1110.30
IBM PowerVM Hypervisor FW1060.00 through FW1060.80 and FW950.00 through FW950.H2

Discovery Timeline

2026-08-19 - CVE-2026-17414 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-17414

Vulnerability Analysis

The vulnerability resides in IBM PowerVM partition firmware, specifically in the network boot code path. During network boot, the partition retrieves a boot image over the network. The firmware fails to properly validate the origin and integrity of the boot transaction. An attacker on the adjacent network can inject responses that either prevent the partition from completing its boot sequence or deliver an attacker-controlled boot image.

When OS secure boot is disabled, no cryptographic signature check validates the substituted image. This gives the attacker code execution authority over everything the partition subsequently loads, including the kernel and userland. Because secure boot is disabled by default on PowerVM partitions, most deployments are exposed to the image substitution scenario rather than only the denial-of-service scenario.

Root Cause

The root cause is improper input validation ([CWE-20]) in partition firmware during network boot. The firmware accepts boot data from unauthenticated network peers without validating source authenticity or image integrity when secure boot is not enforced.

Attack Vector

The attack requires adjacent network access. The attacker must reach the same broadcast domain or network segment as the target partition while it is performing a network boot. No user interaction and no authentication are required. The attacker races or spoofs legitimate boot infrastructure responses to serve a malicious boot image or to disrupt the boot sequence entirely.

See the IBM Support advisory node 7283234 for vendor-provided technical details.

Detection Methods for CVE-2026-17414

Indicators of Compromise

Unexpected or repeatedly failed network boot attempts on PowerVM logical partitions (LPARs).
Rogue DHCP, BOOTP, or TFTP responders appearing on management or boot VLANs during LPAR boot windows.
Partitions booting kernels or bootloaders whose hashes do not match the approved gold image.

Detection Strategies

Capture and inspect DHCP, BOOTP, and TFTP traffic on VLANs used for LPAR network boot to identify unauthorized servers.
Enable and review HMC and PowerVM audit logs for anomalous boot failures or repeated retry patterns.
Compare loaded boot image hashes against a known-good baseline after every network boot event.

Monitoring Recommendations

Alert on new MAC or IP addresses answering DHCP or TFTP requests on network boot segments.
Monitor for ARP anomalies and duplicate DHCP OFFERs during partition boot windows.
Track partition boot completion metrics and alert on abnormal boot durations or repeated boot failures.

How to Mitigate CVE-2026-17414

Immediate Actions Required

Apply the IBM firmware fixes referenced in IBM Support node 7283234 to all affected FW950, FW1060, FW1110, and FW1120 release trains.
Enable OS secure boot on all partitions that use network boot to enforce signature validation of the boot image.
Restrict the network boot VLAN to trusted hosts only and block unauthorized DHCP or TFTP servers with switch-level protections.

Patch Information

IBM has published fix information in the advisory at IBM Support node 7283234. Administrators should upgrade PowerVM Hypervisor firmware to the fixed level identified for their release train: FW1120, FW1110, FW1060, or FW950.

Workarounds

Enable OS secure boot on partitions that must perform network boot so unsigned or tampered boot images are rejected.
Isolate LPAR network boot traffic on a dedicated VLAN with DHCP snooping and dynamic ARP inspection enabled on the switch fabric.
Prefer local disk boot over network boot for production partitions where feasible, reducing exposure to adjacent-network attackers.

bash

# Example: enable DHCP snooping and restrict trusted boot servers on a Cisco switch
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 100
interface GigabitEthernet1/0/1
  description Trusted PowerVM NIM boot server
  ip dhcp snooping trust
end