IBM Power Systems firmware: second FSP mailbox overflow in runtime attribute storage yields firmware code execution

CVSS 8.2CVE-2026-96264Firmware, BMC & network fabriccurated

Impact

A crafted service processor mailbox message overflows host firmware runtime attribute storage and runs arbitrary code in the host firmware runtime, giving full access to the managed system's memory and hardware interfaces. IBM published this under its own advisory with a description indistinguishable from CVE-2026-96262; both are listed separately here because they have separate fixes to confirm, and an operator checking one id should not be told the other is already handled. Practical consequence on a GPU or accelerator node is the same: control below the hypervisor, invisible from inside any partition.

Who can reach it

Local to the service processor, authenticated at high privilege: service-level access to the FSP. Not reachable from a tenant partition or from the host OS.

What to do

Apply the fixed firmware level from IBM support document 7290126; affected levels are FW1060.00 through FW1060.81. Verify both this and IBM's other mailbox advisory are covered by the level you land on. Treat as a firmware flash with the managed system out of service unless IBM states the update is concurrent, and in the meantime confine FSP reachability to the management VLAN.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-96264 https://www.ibm.com/support/pages/node/7290126

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.