CVE-2026-19492: IBM Power System S1122 Information Disclosure

CVE-2026-19492 Overview

CVE-2026-19492 is an information disclosure vulnerability in the IBM PowerVM Hypervisor call interface. An attacker with root access inside a guest logical partition (LPAR) can issue a crafted hypervisor call to read a limited amount of hypervisor memory. The returned contents may include data belonging to the hypervisor itself or to co-tenant guest partitions sharing the same physical system. The attacker cannot control which memory contents are returned, which limits targeted exfiltration but still exposes residual data. The flaw is tracked under [CWE-457: Use of Uninitialized Variable] and affects PowerVM firmware levels FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81.

Critical Impact
Guest-to-hypervisor memory disclosure that breaks tenant isolation on shared IBM Power Systems, exposing confidential data from the hypervisor or neighboring partitions in multi-tenant deployments.

Affected Products

IBM PowerVM Hypervisor firmware FW1120.00 through FW1120.01
IBM PowerVM Hypervisor firmware FW1110.00 through FW1110.31
IBM PowerVM Hypervisor firmware FW1060.00 through FW1060.81 (Power10 and Power9 systems including E1080, E1180, E1050, E1150, S1012/S1014/S1022/S1024, S1112/S1114/S1122/S1124, and L-series models)

Discovery Timeline

2026-09-24 - CVE-2026-19492 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-19492

Vulnerability Analysis

The vulnerability resides in a hypervisor call (hcall) interface exposed by PowerVM to guest partitions. When a guest issues the affected hcall, the hypervisor returns a response buffer that is not fully initialized before being handed back to the caller. The uninitialized bytes contain residual contents of hypervisor memory, which can include fragments of hypervisor state or data from other co-resident LPARs.

Because the disclosure channel runs through the firmware-privileged hcall path, standard guest-level access controls cannot prevent it. The scope change in the vulnerability reflects that a guest root compromise can read data outside its partition boundary. The volume of leaked data per call is bounded and the contents are non-deterministic, so exploitation is a probabilistic data-harvesting technique rather than a direct read primitive.

Root Cause

The root cause is classified as [CWE-457: Use of Uninitialized Variable]. The hypervisor allocates a response structure for the hcall but fails to zero or fully populate every field before copying the buffer into the guest's address space. On systems with heavy LPAR activity, those stale bytes carry recently freed hypervisor working data.

Attack Vector

Exploitation requires local access and root (or equivalent hv-privileged OS) credentials inside a guest partition running on an affected PowerVM firmware level. The attacker invokes the vulnerable hcall repeatedly from the guest kernel or a privileged user-space helper and aggregates the returned uninitialized bytes. Over many iterations, the attacker can accumulate meaningful fragments such as credentials, cryptographic material, or partition metadata belonging to the hypervisor or neighboring guests. No network path or user interaction is required, and the attack is particularly relevant to multi-tenant hosting environments where guest OS images are not trusted.

Detection Methods for CVE-2026-19492

Indicators of Compromise

Unusually high rates of hypervisor call invocations originating from a single LPAR, especially from kernel modules or processes that do not normally interact with the hcall interface.
Presence of unknown kernel modules, LD_PRELOAD libraries, or custom binaries on a guest partition that reference PowerVM hcall opcodes.
Partition-level audit records showing root-privilege escalation shortly before sustained hcall activity.

Detection Strategies

Baseline normal hcall usage per LPAR using Hardware Management Console (HMC) and PowerVM performance telemetry, then alert on statistical outliers.
Deploy endpoint protection within guest operating systems (AIX, IBM i, Linux on Power) to flag privilege escalation and unauthorized kernel module loads that could precede hcall abuse.
Correlate guest OS audit logs with HMC partition activity to identify root sessions that coincide with firmware-interface anomalies.

Monitoring Recommendations

Forward guest OS auth, sudo, and kernel audit logs to a centralized analytics platform for cross-partition correlation.
Monitor firmware level inventory across the fleet and alert when any managed system drifts to an unpatched FW1060, FW1110, or FW1120 build.
Track administrative access to HMC and partition consoles, since guest root is the prerequisite for exploitation.

How to Mitigate CVE-2026-19492

Immediate Actions Required

Inventory all IBM Power9 and Power10 systems and identify any running PowerVM firmware in the FW1060, FW1110, or FW1120 streams within the vulnerable ranges.
Apply the fixed firmware levels published by IBM in advisory IBM Support 7289137 at the earliest maintenance window.
Review and tighten controls on which users and automation accounts hold root inside guest partitions, especially on hosts running mixed-tenant workloads.

Patch Information

IBM has released updated PowerVM Hypervisor firmware that initializes the affected hcall response buffer before returning control to the guest. Refer to the IBM Support advisory for node 7289137 for the exact fix levels corresponding to FW1060, FW1110, and FW1120, and schedule a concurrent firmware update through the HMC where supported.

Workarounds

No vendor-supplied workaround eliminates the vulnerability without the firmware update; firmware remediation is the only complete fix.
Reduce exposure by consolidating untrusted or customer-controlled guest images onto systems that have already been patched, and keep sensitive workloads on separate, patched managed systems.
Enforce least privilege within guest OS images so that root is restricted to a minimal set of accounts, and monitor those accounts for anomalous hcall activity.

bash

# Example: verify current PowerVM system firmware level from the HMC CLI
# and compare against the fixed levels in IBM advisory 7289137
lssyscfg -r sys -F name,type_model,serial_num,system_firmware

# From an AIX guest partition, display the installed system firmware level
lsmcode -A