IBM PowerVM Hypervisor CVE-2026-17097

Exploitation requires root (superuser) access to a guest partition running on a vulnerable IBM PowerVM firmware version (FW950.00 through FW950.H2, FW1060.00 through FW1060.80, FW1110.00 through FW1110.30, or FW1120.00). The attack is local to the guest partition (AV:L); the attacker cannot exploit this remotely without first compromising root on the guest. No special non-default configuration is required - the hypervisor call interface is a standard facility available to all guest partitions. The primary limiting factor is the requirement for guest root privilege, which constrains exploitation to authorized administrators or attackers who have already achieved full guest compromise. The attacker has no control over the location of any injected data in memory, limiting the utility of the integrity sub-impact for further exploitation.

The CVSS 7.3 score with AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H conveys a meaningful real-world risk in multi-tenant POWER environments, particularly where guest partitions are administered by parties distinct from the platform operator. The Availability:High rating is well-justified - a full platform re-IPL is a severe recovery action that disrupts all guests simultaneously, not just the attacker's partition. IBM's assigned PR:L merits scrutiny: the description explicitly requires root access to the guest partition, which aligns more closely with PR:H by conventional CVSS 3.1 interpretation, though IBM may be scoring from the hypervisor's trust boundary perspective, where any guest is inherently 'low privilege.' The Integrity:Low rating reflects the uncontrolled data injection scenario - while concerning architecturally, the absence of attacker control over the target memory location substantially limits exploitation of this sub-impact. No EPSS data is available for this CVE, and it is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at time of analysis. In practice, risk is highest in shared infrastructure or cloud-like POWER environments; in single-tenant deployments where guest root and platform ownership align, the risk is significantly reduced to a privilege-escalation-adjacent concern.

A system administrator or attacker who has gained root access to a guest partition on a vulnerable IBM POWER system constructs a malformed hypervisor call with an out-of-bounds array index, triggering the CWE-129 flaw in the hcall handler. The hypervisor's improper validation causes an internal state corruption that permanently stalls the associated virtual processor, and the platform operator is forced to perform a full system re-IPL - taking all other co-resident guest partitions offline in the process. In some invocations of this scenario, the corruption pathway may also write a small amount of uncontrolled data into hypervisor or partition memory, though the attacker cannot direct where this lands.