IBM PowerVM CVE-2026-11885

Exploitation requires the attacker to already execute code inside a Power logical partition with at least low-level OS privileges (PR:L) so they can invoke hypervisor calls; the specific prerequisite is the ability to issue a carefully crafted OS-to-hypervisor call (hcall) that triggers the unchecked buffer copy. Limiting factors: this is a local vector (AV:L) with no remote or network path and no unauthenticated entry, so an attacker must first gain a foothold in a partition; affected firmware is limited to FW1110.00-FW1110.20, FW1060.00-FW1060.71, and FW950.00-FW950.H1, so systems on other or patched firmware levels are not exploitable. The scope-change nature (S:C) means the value at risk is the shared hypervisor and neighboring partitions, making multi-tenant frames the highest-concern deployments.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H (8.4, High) tells a consistent and credible story: the attack is local (AV:L, must run code inside a partition), of low complexity (AC:L), requires only low privilege (PR:L, an OS account within a guest LPAR), needs no user interaction, and produces high integrity and availability impact with a scope change (S:C) reflecting that a guest-level call damages the underlying hypervisor. Confidentiality impact is rated none (C:N), so this is a memory-integrity and denial-of-service problem rather than a data-disclosure one. No EPSS score, SSVC decision, KEV listing, or POC was provided, so real-world exploitation probability cannot be quantified from the input; the local vector and reliance on a crafted hcall suggest a non-trivial but realistic threat, particularly in multi-tenant or hostile-workload partitions. This is a genuine priority for shared PowerVM estates because the scope change means one compromised or malicious partition can degrade the platform for its neighbors, but the local-access requirement limits mass or remote exploitation.

An attacker who has obtained low-privileged OS access within a Power logical partition (for example a compromised application account on an AIX, IBM i, or Linux guest) issues a specially crafted hypervisor call that overflows an internal PowerVM buffer, crashing the hypervisor for the whole frame or corrupting OS memory. No public exploit is identified at time of analysis, and the low attack complexity means a working exploit would be reliable once the hcall path is understood.