CVE-2026-17042
HighCVSS 7.3Summary
IBM Power Systems Firmware in specific versions has a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption, requiring operator intervention to restore normal operation.
Risk Assessment
The risk includes integrity and availability impact to the managed system, but only for OpenPOWER systems; PowerVM systems are not affected.
Recommendation
Apply available firmware updates from IBM for affected versions.
Original NVD description (English source)
IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.