EUVD-2026-62531
GHSA-vf7p-vx9f-2xvg
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
TOCTOU exploitation requires winning a kernel-level timing race, making AC:H more accurate; all other metrics from the vendor vector are retained.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.
AnalysisAI
IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, expose a time-of-check time-of-use (TOCTOU) race condition that local, unprivileged attackers can exploit to corrupt data integrity or crash the system. The flaw requires only local shell access with no privileges, making it exploitable by any local user account on affected POWER-architecture systems. No public exploit code or CISA KEV listing exists at time of analysis, though a vendor patch is available.
Technical ContextAI
CWE-367 (TOCTOU Race Condition) describes vulnerabilities where a security-relevant resource - such as a file, directory, or kernel object - is checked for a condition at one moment and then acted upon later, with the window between check and use allowing an attacker to substitute or alter the resource. IBM AIX is a UNIX-based operating system running exclusively on IBM POWER hardware, widely deployed in high-availability enterprise and financial workloads. PowerVM VIOS (Virtual I/O Server) is the virtualization layer that mediates I/O between logical partitions (LPARs) on IBM POWER systems. CPE strings cpe:2.3:a:ibm:aix and cpe:2.3:a:ibm:powervm_vios confirm both products as affected. Because VIOS is a shared infrastructure component, exploitation there could have downstream effects on hosted LPARs depending on which kernel subsystem contains the race.
RemediationAI
Apply the patch provided by IBM per advisory node/7283858 at https://www.ibm.com/support/pages/node/7283858. The exact patched AIX and VIOS maintenance level or APARs are detailed in that advisory and should be referenced directly, as no specific fix version is independently confirmed in available data. As a compensating control where patching is not immediately possible, restrict local user access on AIX and VIOS management partitions to the minimum required set of trusted accounts, reducing the pool of potential exploiters; note this does not eliminate the vulnerability but raises the bar for exploitation. On PowerVM VIOS, minimizing the number of users with interactive shell access to the VIOS management partition is especially important given the shared infrastructure role of that component.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today