CVE-2026-17121

This CVE exposes uncontrolled recursion in IBM AIX and PowerVM's virtualization control plane. A remote attacker can send specially crafted network input that triggers unbounded recursive calls, causing the system to hang or panic. The attack requires no authentication and can be delivered over the network, making it exploitable against any exposed AIX or PowerVM VIOS instance. The vulnerability almost certainly represents a tooling gap rather than a tooling failure—IBM's development environment for AIX likely lacks static analysis rules that flag recursive functions without explicit depth limits. This is characteristic of legacy codebases that predate modern SAST adoption. The relevant question for your forensic review is whether this is a regression (recent code changes made a previously internal function network-reachable) or latent code that has existed for years in a path everyone considered stable. Check your AIX and PowerVM versions against IBM's advisory. If you run vulnerable versions, treat this as infrastructure-critical: PowerVM VIOS is a hypervisor component, so a successful exploit doesn't crash a single VM—it destabilizes the entire host and every workload on that physical system. That blast radius exceeds what the CVSS 7.5 score suggests. The operational reality compounds the risk. AIX patching requires system reboots, and enterprise environments schedule maintenance windows weeks in advance. The exposure window between CVE publication and actual patch deployment could be months—a long runway for an attacker who knows this vulnerability. Prioritize this remediation despite the moderate CVSS score, because deployment latency transforms a 7.5 hypervisor DoS into an operationally severe exposure. Beyond patching, audit your codebase for other recursive paths lacking depth limits. Where one unbounded recursion exists, others almost certainly do too. This is a systemic pattern in mature codebases where recursive parsers were extended without corresponding defensive checks, and the same development culture that produced this flaw likely produced others.

Reviewed through automated stages and approved by a human before publication.