IBM AIX CVE-2026-17009

Local authenticated access with at least low-privilege credentials (PR:L) is required - remote unauthenticated exploitation is not possible given AV:L. High attack complexity (AC:H) means a specific system condition, timing window, or sequence of operations must be achieved, consistent with a kernel-level race condition rather than a simple, reproducible trigger. Impact is strictly limited to availability (system crash/denial of service); no data exfiltration or privilege escalation is possible from this flaw. Exploitation is further constrained to IBM POWER-architecture hardware running AIX 7.2/7.3 or PowerVM VIOS 4.1 - x86 and other platforms are unaffected.

The CVSS 3.1 base score of 4.7 (Medium) accurately reflects constrained real-world risk. The vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H means an attacker must have local authenticated access with low privileges, must overcome high attack complexity (likely a race condition), and can only crash the system - there is no confidentiality or integrity impact. EPSS data is not provided in available intelligence; however, the combination of local-only vector, high complexity, and availability-only impact makes opportunistic or automated exploitation unlikely. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified, further reducing prioritization urgency in most environments. For AIX and PowerVM VIOS deployments in critical infrastructure (financial, industrial), even a local DoS can be operationally significant due to uptime requirements, which elevates contextual priority above what the CVSS score alone suggests.

A local user with a low-privileged account on an IBM AIX or PowerVM VIOS system constructs or times a specific system interaction - likely a race condition against a shared kernel resource - to trigger a NULL pointer dereference in a kernel subsystem, inducing a kernel panic and crashing the system. No public exploit code is known, and the high attack complexity means reliable exploitation requires knowledge of internal kernel state or timing. For PowerVM VIOS environments, a successful crash could disrupt I/O services for all hosted logical partitions.