CVE-2026-19442: CWE-822 Untrusted Pointer Dereference in IBM AIX

This vulnerability (CVE-2026-19442) affects IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It arises from an untrusted pointer dereference (CWE-822) in the AIX Virtual SCSI (vSCSI) initiator driver. Successful exploitation may cause denial of service, privilege escalation, or full compromise of the client LPAR kernel. The CVSS 3.1 base score is 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating local attack complexity, high privileges required, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability.

The vulnerability allows an attacker with high privileges and local access to exploit the pointer validation flaw in the vSCSI initiator driver, potentially causing denial of service, privilege escalation, or complete kernel compromise of the client LPAR. This can lead to full control over the affected system's kernel, severely impacting system security and stability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict local access to trusted users only and monitor for unusual activity related to the vSCSI driver.