Description

IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in host firmware NVRAM parsing. An attacker with root access to a guest partition on an OpenPOWER system can write a specially crafted NVRAM image, causing the host firmware boot stage to crash with possible memory corruption. This condition persists until operator intervention — clearing NVRAM via the service processor — to restore normal operation. This vulnerability only affects OpenPOWER systems; systems running PowerVM are not affected. Successful exploitation results in an integrity and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T20:17:12.127Z",
  "pubdate": "2026-08-19T20:17:12.127Z",
  "executiveSummary": "A host firmware NVRAM parsing vulnerability affects IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC).\nThe vulnerability is characterized by improper parsing of NVRAM images during the host firmware boot stage.\nSuccessful exploitation allows an authenticated attacker with root access to a guest partition on an OpenPOWER system to cause a host firmware boot stage crash accompanied by possible memory corruption.\nThe resulting condition creates a persistent denial of service that requires explicit operator intervention, specifically clearing NVRAM via the service processor, to restore normal system operation.\nSystems running PowerVM are not affected by this vulnerability, which is exclusively localized to OpenPOWER configurations.\nThe primary risk implications involve severe integrity and availability impacts to the managed system due to persistent host-level failure.",
  "technicalDetails": "The vulnerability resides within the host firmware NVRAM parsing component of affected IBM Power Systems and HMC firmware versions.\nThe root cause stems from insufficient validation and bounds checking when the host firmware processes NVRAM configuration data during the initialization and boot stages.\nPrerequisites for exploitation mandate that an attacker possesses root-level privileges within a guest partition running on an OpenPOWER system, granting them the necessary access context to modify or supply the NVRAM image.\nThe attack flow begins with the privileged guest user crafting a malicious or malformed NVRAM image designed to trigger parsing anomalies within the host firmware.\nUpon subsequent system reboot or initialization, the host firmware attempts to parse the corrupted NVRAM image.\nThe lack of proper input validation during this parsing routine leads to memory corruption conditions and a subsequent crash of the host firmware boot process.\nBecause the malformed NVRAM state persists across reboots, the host firmware repeatedly encounters the parsing failure, resulting in a persistent denial of service state.\nRecovery from this fault condition cannot be achieved through standard remote reboots and strictly requires physical or administrative operator intervention to clear the NVRAM state via the service processor.\nNetwork exposure is not a direct vector; the attack relies entirely on internal guest-to-host interface boundary crossings via local administrative access within a guest partition."
}