IBM Power Systems Firmware: BMC/FSP root can read and disrupt host processor state across all partitions

Impact

A second flaw in the same BMC/FSP-to-host interface lets an attacker with the service account or root on the service processor reach into and disrupt host processor state. IBM scores it as scope-changed with confidentiality and availability impact on the managed system and every hosted partition — read access to state that belongs to other partitions, and the ability to wedge the machine. Integrity is not claimed here, which distinguishes it from CVE-2026-17429, but the availability half alone means one compromised BMC can drop a whole node and everything scheduled on it.

Who can reach it

Local to the service processor: service account or root on the BMC/FSP. Authenticated; not reachable from a partition or a tenant workload.

What to do

Affected levels are FW1120.00, FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80; IBM's support document (node 7283219) carries the fix levels. Expect a firmware flash with the managed system out of service — batch it with the other Power firmware fixes published the same day rather than opening three windows per machine.

References