Database/Firmware, BMC & network fabric
IBM Power Systems firmware: guest-partition root can write NVRAM that crashes the host firmware boot stage
Impact
An attacker with root inside a guest partition on an OpenPOWER system can write a crafted NVRAM image that makes the host firmware boot stage crash, with possible memory corruption. The damage outlives the attacker's partition: the machine stays in that state until an operator clears NVRAM through the service processor, so the node does not recover on its own reboot. For an accelerated OpenPOWER node this is a guest-to-host denial of service that costs an out-of-band recovery trip rather than a reboot cycle, and it takes every other partition on the machine down with it. Only OpenPOWER systems are affected; PowerVM systems are not.
Who can reach it
Local — root within a guest partition on an OpenPOWER host running the affected firmware levels (FW950.00 through FW950.H2, OP940.00 through OP940.a1 on Power9, OP940.00 through OP940.81 on the Power HMC). No management-network or physical access is needed.
What to do
Apply the IBM firmware update named in the advisory for your FW950 or OP940 level. That is a firmware flash and needs the system out of service for the update window. A machine already in the crashed state must have its NVRAM cleared from the service processor before it will boot again.
References
Related entries
- Linux kernel (drivers/infiniband/hw/irdma): Queue-depth arithmetic was done in 32 bits, so a tenant passing a hugeCVE-2026-31491 · Linux kernel (drivers/infiniband/hw/irdma)High
- Dell OMSA: externally controlled class selection bypasses a protection mechanismCVE-2026-66269 · Dell OpenManage Server Administrator (unsafe reflection)High
- Dell OMSA: local low-privileged user reads sensitive information beyond the agent's scopeCVE-2026-80356 · Dell OpenManage Server Administrator (sensitive information exposure)High
- Dell OMSA: hard-coded credentials give an unauthenticated remote attacker accessCVE-2026-81440 · Dell OpenManage Server Administrator (hard-coded credentials)High
- AMD SEV / SEV-ES - missing nested page table protection: SEV and SEV-ES do not protect the nested page tables, so aCVE-2020-12967 · AMD SEV / SEV-ES - missing nested page table protectionHigh
- ArubaOS GRUB2 implementation (secure boot): Two flaws in ArubaOS's GRUB2 implementation allow secure bootCVE-2020-24637 · ArubaOS GRUB2 implementation (secure boot)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.