IBM AIX CVE-2026-16924

The target system must have IPsec configured and actively processing inbound IPsec traffic - the flaw is triggered during decapsulation, so it requires the system to be operating as an IPsec endpoint (tunnel or transport mode). Systems that do not have IPsec policies or tunnels active are not exposed to this code path. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that beyond network reachability and IPsec being enabled, no authentication, special privileges, or user interaction are required. Exploitation is limited to AIX 7.2, 7.3, and PowerVM VIOS 4.1 on IBM POWER hardware. Environments that enforce perimeter firewall rules blocking ESP (protocol 50), AH (protocol 51), UDP/500, and UDP/4500 from untrusted sources significantly reduce exposure, as the attacker must be able to deliver IPsec packets directly to the vulnerable endpoint.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H places this vulnerability in the highest-accessibility tier for a DoS class finding: fully remote, unauthenticated, low complexity, and no user interaction required. The practical constraint is that the target system must be processing IPsec traffic, which limits exposure to systems acting as IPsec endpoints - still a large cohort in enterprise IBM POWER environments. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified from available signals. The vulnerability is not listed in CISA KEV and no POC is known, reducing urgency relative to a KEV-listed finding of similar CVSS score. The real-world impact is limited to availability - a system crash or service disruption - with no data exfiltration or integrity risk, which narrows the blast radius. Nonetheless, PowerVM VIOS disruption in a virtualized environment could cascade to all dependent logical partitions sharing I/O, amplifying the impact beyond a single host; even a mid-sized infrastructure team in swidnica operating a consolidated POWER virtualization stack should treat this as urgent if IPsec is in use. IBM's patch availability reduces remediation friction.

An attacker with network access to an IBM AIX or PowerVM VIOS system acting as an IPsec endpoint crafts malformed IPsec-encapsulated packets designed to trigger integer underflow in the memory offset calculation during decapsulation. The kernel processes the packet, computes an invalid memory offset, and either panics or enters an unrecoverable state, taking the system offline. No public proof-of-concept exploit code is known at time of analysis, but the low-complexity CVSS vector suggests the trigger condition is straightforward to reproduce once the code path is understood.