Description
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations.
Published: 2026-08-19
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from improper handling of memory page table configurations, allowing a local attacker to trigger a denial of service. The flaw can lead to a system crash or an unresponsive state, compromising availability of IBM AIX and PowerVM VIOS instances.

Affected Systems

Affected systems include IBM AIX 7.2 and 7.3 (including Service Packs such as AIX 7.3 TL04 SP2, AIX 7.3 TL03 SP3, AIX 7.3 TL02 SP5, and AIX 7.2 TL05 SP13) and IBM PowerVM VIOS 4.1 (covering Fix Packs 4.1.2.20, 4.1.1.30, and 4.1.0.50). These SPs/FPs are cumulative and can be applied atop earlier levels.

Risk and Exploitability

The CVSS base score of 6.5 indicates a medium severity risk of denial of service. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. The attack requires local access; a privileged local user can manipulate memory page tables to bring the system or virtual machine to an unresponsive state.

Generated by OpenCVE AI on August 20, 2026 at 00:54 UTC.

Remediation

Vendor Solution

A.  APARS IBM has assigned the following APARs to this problem: AIX LevelAPARAvailability  SPKEY7.2.5IJ5956608/14/2026SP13key_w_apar7.3.2IJ5956508/14/2026SP05key_w_apar7.3.3IJ5956408/14/2026SP03key_w_apar7.3.4IJ59563 08/14/2026SP02key_w_apar VIOS LevelAPARAvailability SPKEY4.1.0IJ5956508/14/20264.1.0.50key_w_apar4.1.1IJ5956408/14/20264.1.1.30key_w_apar4.1.2IJ5956308/14/20264.1.2.20key_w_apar B.  FIXES IBM strongly recommends addressing the vulnerability now.  AIX and VIOS fixes are available and can be downloaded from Fix Central: https://www.ibm.com/support/fixcentral  An LPAR reboot is required to complete the SP/FP update. On AIX, Live Update can be used to avoid a reboot.  IBM has assigned the following AIX Service Packs (SPs) and VIOS Fix Packs (FPs) as the remediation levels for the published vulnerabilities. AIX Level Service PackAIX 7.3 TL04SP2AIX 7.3 TL03SP3AIX 7.3 TL02SP5AIX 7.2 TL05 SP13 PowerVM VIOS LevelFix PackVIOS 4.1.2 4.1.2.20VIOS 4.1.1 4.1.1.30VIOS 4.1.0  4.1.0.50 Note: These SPs/FPs are cumulative and include fixes for all previously published AIX/VIOS security vulnerabilities. They can be applied on top of any earlier affected level of the TL . Note: To apply these patches using nimsh secure, special steps must be taken as the protocol between master and client is updated to be more secure. Please read this article: https://www.ibm.com/support/pages/node/7283157 Note: For VIOS 4.1.0 and VIOS 4.1.1, additional steps are required to migrate to the latest Postgres15 after applying the 4.1.1.30 or 4.1.0.50 FPs above. Instructions to do that can be found here:                             4.1.0.50 post-update instructions: https://www.ibm.com/support/pages/node/7283819           4.1.1.30 post-update instructions: https://www.ibm.com/support/pages/node/7283823

OpenCVE Recommended Actions

  • Apply the relevant IBM Service Pack or Fix Pack for your AIX or VIOS version from Fix Central; this patch corrects the underlying memory page table handling flaw described by CWE‑400.
  • On AIX, use Live Update to apply the update without reboot, otherwise reboot the LPAR to complete Service Pack installation.
  • For VIOS 4.1.0 or 4.1.1, after installing the FP, execute IBM’s post‑update instructions to migrate to Postgres15 per the posted links.

Generated by OpenCVE AI on August 20, 2026 at 00:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations.
Title Vulnerabilities in IBM AIX and PowerVM VIOS
First Time appeared Ibm
Ibm aix
Ibm vios
Weaknesses CWE-400
CPEs cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm aix
Ibm vios
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'}

Subscriptions

Ibm Aix Vios
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-19T17:50:33.343Z

Reserved: 2026-08-12T18:09:01.704Z

Link: CVE-2026-19653

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-19T18:16:36.407

Modified: 2026-08-19T18:16:36.407

Link: CVE-2026-19653

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T01:00:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption