CVE-2026-17097: CWE-129 Improper Validation of Array Index in IBM PowerVM Hypervisor

IBM PowerVM Hypervisor versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 contain a vulnerability (CWE-129) due to improper validation of array indices in the hypervisor call interface. An attacker with root privileges on a guest partition can issue a crafted hypervisor call that causes a virtual processor to become permanently unresponsive, necessitating a full platform re-initialization (re-IPL). In some cases, the exploit may also cause a small amount of data to be injected into hypervisor or partition memory at uncontrolled locations. This results in integrity and availability impacts on the managed system. The CVSS v3.1 score is 7.3 (High severity) with attack vector local, low attack complexity, low privileges required, no user interaction, and scope changed.

Successful exploitation leads to a denial of service condition where a virtual processor becomes permanently unresponsive, requiring a full platform reboot to restore operation. There is also a potential integrity impact due to uncontrolled data injection into hypervisor or partition memory. Confidentiality is not affected. The overall impact affects system integrity and availability.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict root access to guest partitions to trusted administrators only and monitor for unusual hypervisor call activity.