CVE-2026-17091: CWE-190 Integer Overflow or Wraparound in IBM PowerVM Hypervisor

IBM PowerVM Hypervisor contains an integer overflow or wraparound vulnerability in its hypervisor call interface. Specifically, an attacker with root privileges on a guest partition can send a specially crafted hypervisor call that causes an integer overflow, allowing injection of arbitrary amounts of data into hypervisor or partition memory. This results in either a crash causing a full platform re-initialization (IPL) terminating all hosted partitions or corruption of memory. The hypervisor restarts automatically after a crash, but repeated exploitation can degrade system availability. The vulnerability affects multiple versions of the PowerVM Hypervisor as listed. The CVSS v3.1 score is 8.4 (high severity) with an attack vector of local, low complexity, privileges required, no user interaction, and scope changed. The impact is high on integrity and availability, with no confidentiality impact.

Successful exploitation allows an attacker with root access on a guest partition to cause a crash of the hypervisor or corrupt memory, resulting in termination of all hosted partitions and a full platform reboot. Although the hypervisor restarts automatically, repeated exploitation can cause sustained availability degradation. The integrity of the managed system can also be compromised due to memory corruption. There is no confidentiality impact reported.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit root access to guest partitions and monitor for unusual hypervisor call activity to reduce risk.