IBM Power Systems firmware: FSP mailbox message overflows runtime attribute storage, giving host firmware code execution

CVSS 8.2CVE-2026-96262Firmware, BMC & network fabriccurated

Impact

An attacker with authenticated service-level access to the flexible service processor can send a crafted mailbox message that overflows host firmware runtime attribute storage and executes arbitrary code in the host firmware runtime. That is below the PowerVM hypervisor: it yields full access to the managed system's memory and hardware interfaces, so every partition on the node, and any accelerator attached to it, is within reach of the attacker regardless of partition isolation. Nothing an operator does inside a partition detects or contains this. IBM tracks a second mailbox-overflow issue with an indistinguishable description under its own advisory (CVE-2026-96264); treat them as two fixes to apply, not one.

Who can reach it

Local to the service processor and authenticated at high privilege: service-level access to the FSP, i.e. someone who already holds service credentials or has compromised the HMC/management path. Not reachable from a tenant partition.

What to do

Apply the fixed firmware level from IBM support document 7290125; affected levels are FW1060.00 through FW1060.81. Because the flaw executes in host firmware runtime, treat the update as a firmware flash with the managed system out of service unless IBM's document states the fix is concurrent. Interim control: the only gate is FSP authentication and network reach, so lock the service processor to the management VLAN and rotate service credentials.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-96262 https://www.ibm.com/support/pages/node/7290125

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.