IBM PowerVM Hypervisor CVE-2026-17091

Exploitation requires root (superuser/UID-0) access within a guest logical partition (LPAR) running on IBM POWER hardware with an affected PowerVM firmware version - this is the single hard prerequisite from which all other conditions follow. The vulnerable code path is the hypervisor call (hcall) interface, which is accessible to any root process in a guest; no specific non-default configuration or optional feature needs to be enabled. Affected firmware spans FW950.00-FW950.H2, FW1060.00-FW1060.80, FW1110.00-FW1110.30, and FW1120.00. Exploitation is limited by: (1) the requirement for root-level OS access inside a guest, meaning an attacker must first fully compromise the guest OS; (2) the local attack vector - this cannot be triggered remotely from outside the guest without a separate privilege escalation chain; (3) physical or logical access to IBM POWER hardware, excluding commodity x86 environments. Repeated automated exploitation is noted in the description as required for sustained availability impact, since the hypervisor restarts automatically after a crash.

The CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H) correctly captures the two defining characteristics of this vulnerability: a low-complexity local exploit that escapes guest-partition boundaries. The Scope:Changed metric is the critical signal - successful exploitation does not stay contained to the attacker's own LPAR but can destabilize or corrupt the entire physical Power server and all co-hosted partitions. Despite the high CVSS score, real-world risk is constrained by the requirement for root access within a guest partition (PR:L), meaning the attacker pool is limited to compromised administrators, malicious insiders, or attackers who have already achieved full guest-OS compromise. No EPSS score was provided in the input data; risk cannot be quantified probabilistically from available signals. KEV status is negative and no POC is publicly known, so opportunistic mass exploitation is not a current concern. The availability risk is amplified in multi-tenant environments where one malicious guest admin can trigger a platform-wide re-IPL, constituting a denial-of-service against all other tenants. The IBM advisory at https://www.ibm.com/support/pages/node/7283229 confirms patch availability, which substantially reduces residual risk for patched systems.

An attacker who has obtained root access inside a guest LPAR on an affected IBM POWER server issues a specially crafted hypervisor call with parameters engineered to trigger the integer overflow in the PowerVM hcall interface. The overflowed size value causes the hypervisor to write an attacker-controlled volume of data beyond an intended memory boundary into hypervisor or adjacent partition memory, either corrupting critical hypervisor state and forcing a full platform re-IPL that kills all co-hosted LPARs, or selectively corrupting memory in a neighboring partition for targeted integrity impact. No public exploit code has been identified at time of analysis.