Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call causing a virtual processor to become permanently unresponsive, requiring a full platform re-IPL to restore normal operation. In some cases this may also cause the guest to inject a small amount of data into hypervisor or partition memory with no attacker control over the target location. Successful exploitation results in an integrity and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T20:17:12.797Z",
  "pubdate": "2026-08-19T20:17:12.797Z",
  "executiveSummary": "A hypervisor call interface vulnerability exists in the IBM PowerVM Hypervisor affecting multiple firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The vulnerability allows an authenticated attacker with root access within a guest partition to issue a specially crafted hypervisor call. Successful exploitation leads to a denial of service condition by causing a virtual processor to become permanently unresponsive, necessitating a full platform re-IPL to restore normal operational state. Additionally, certain exploitation vectors may result in the unintentional injection of a small volume of data into hypervisor or partition memory, albeit without attacker control over the destination memory address. This vulnerability impacts both system integrity and availability. Prerequisites for exploitation include obtaining root privileges within a guest partition to interact directly with the hypervisor call interface.",
  "technicalDetails": "The vulnerability resides within the PowerVM hypervisor call interface, specifically in how the hypervisor validates and processes inputs received from guest partition operating systems. The root cause stems from improper input validation and exception handling when processing hypervisor calls (hcalls) issued from guest contexts. An attacker who has achieved root privileges inside a guest partition can construct and execute a malformed or specially crafted hypervisor call that violates the expected operational constraints of the virtualization layer. Upon execution, the malformed hcall triggers an unhandled state or resource deadlock within the hypervisor scheduler or virtual processor management subsystem. This condition causes the targeted virtual processor to transition into a permanently unresponsive state. Because the virtualization layer fails to recover the affected virtual processor dynamically, the underlying physical system or managed partition control structure remains compromised until a full platform re-IPL (Initial Program Load) is performed. Furthermore, the exploitation mechanism may induce memory corruption behavior where a small amount of residual data is injected into hypervisor memory spaces or adjacent partition memory regions. The attacker lacks control over the target memory location, limiting the predictability of this secondary memory injection behavior, but the resultant state violates hypervisor memory integrity. Authentication and privilege requirements mandate that the threat actor already possesses root-level access within a local guest partition to interface with the hypervisor boundary. The attack flow begins with privilege escalation inside a guest partition, followed by the direct invocation of the vulnerable hypervisor call interface using low-level kernel routines or debugging utilities capable of issuing custom hcalls. The impact spans complete availability loss of the affected virtual processor requiring administrative platform restarts, alongside localized integrity impacts due to uncontrolled memory writes within the hypervisor boundary."
}