EUVD-2026-62661
GHSA-vw8q-78h4-w2gf
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-privilege shell access required; S:C reflects VIOS hypervisor scope impact; no confidentiality or integrity impact observed.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations.
AnalysisAI
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Technical ContextAI
IBM AIX is a Unix-based operating system running on IBM Power hardware, with versions 7.2 and 7.3 confirmed affected per CPE cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:*. IBM PowerVM VIOS 4.1 (cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*) is the Virtual I/O Server component of the PowerVM hypervisor platform, acting as an intermediary that shares physical I/O resources among logical partitions (LPARs). The root cause is CWE-400 (Uncontrolled Resource Consumption): the kernel's memory page table management subsystem - which maintains virtual-to-physical address mappings for running processes - fails to properly validate or bound resource allocation under certain configurations. This allows a local process to trigger a condition where kernel memory resources are exhausted without appropriate throttling or error handling. The CVSS S:C (Scope Changed) metric reflects that in a VIOS environment, a crash in the Virtual I/O Server can deprive guest LPARs of I/O resources, extending the blast radius beyond the directly attacked OS instance.
RemediationAI
IBM has released a patch addressing this vulnerability, available through the IBM Support portal at https://www.ibm.com/support/pages/node/7283858. Administrators should consult this advisory to identify the specific APARs (Authorized Problem Analysis Reports) and interim fix packages applicable to their AIX Technology Level and VIOS version, then apply them during the next available maintenance window. Exact patched version identifiers are not independently confirmed from the available data - the IBM advisory page is the authoritative source for fix level details. As a compensating control where immediate patching is not feasible, restrict local shell and console access to AIX and VIOS systems to the minimum required set of named accounts, removing or locking any general-purpose low-privilege accounts; this raises the bar for exploitation since PR:L access is required, though it does not eliminate risk from authorized low-privilege users. Additionally, monitoring for anomalous kernel memory consumption or unexpected system reboots can provide early warning. Note that restricting user accounts may impact legitimate administrative workflows and should be evaluated against operational requirements.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today