IBM AIX CVE-2026-17195

Exploitation requires an authenticated local session on an IBM AIX 7.2/7.3 or PowerVM VIOS 4.1 system with at least low-privilege access (PR:L per CVSS vector) - the attacker must be able to execute code on the target host. Remote unauthenticated exploitation is not possible given AV:L (local attack vector). The scope change (S:C) suggests the vulnerability may be reachable from a guest LPAR in a way that impacts the VIOS host, but this guest-to-VIOS exploitation path is not explicitly confirmed by available data and should be verified with IBM. No special non-default configuration appears required beyond having a valid local account. Exploitation is strictly limited to availability impact (denial of service); there is no confidentiality or integrity exploitation path indicated by available data.

The CVSS 6.5 Medium base score reflects a local, low-complexity, low-privilege attack with no confidentiality or integrity impact but a high availability consequence and changed scope. In a multi-tenant Power Systems environment, the scope change is the key risk multiplier: a single low-privileged user on a VIOS or a guest LPAR triggering this flaw could bring down I/O for every partition sharing that VIOS - an outage pattern common to production IBM Power environments. Standalone AIX deployments without shared VIOS architecture face only single-system DoS, which materially lowers real-world impact. No EPSS score was provided, no CISA KEV listing exists, and no POC has been publicly disclosed, indicating this is not under active widespread exploitation. The vulnerability's requirement for local access (AV:L) and low privilege (PR:L) limits the attack surface to authenticated system users, reducing risk compared to network-exploitable vulnerabilities. Priority should be elevated for production PowerVM environments with shared VIOS; standard patching timelines are appropriate for isolated AIX hosts.

A low-privileged local user on an IBM AIX or VIOS system executes a crafted operation - most likely a system call or kernel-level request - that triggers the out-of-bounds write in a vulnerable kernel or VIOS component. The resulting memory corruption causes a kernel panic or VIOS process crash. In a shared PowerVM environment, the VIOS crash immediately disrupts I/O access for all guest LPARs depending on that VIOS for storage and network, taking down multiple production workloads simultaneously.