Power11 System Firmware Fix History - Release levels MX11xx

IMPORTANT NOTE: Some of these issues are deferred fixes such that the security issue is not fully mitigated until a re-ipl of the system has been completed

The following fixes are being released to mitigate management network attacks against the service processor:

• A problem was fixed in the SMS IPv6 parameters menu to correctly validate the TFTP filename input.
• A security problem was fixed for CVE-2026-16687
• A security problem was fixed for CVE-2026-16835
• A security problem was fixed for CVE-2026-16832
• A security problem was fixed for CVE-2026-18848
• A security problem was fixed for CVE-2026-16828
• A security problem was fixed for CVE-2026-18681
• A security problem was fixed for CVE-2026-16938

The following fixes are being released to mitigate service processor attacks against the host:

• A security problem was fixed for CVE-2026-16933
• A security problem was fixed for CVE-2026-18871
• A security problem was fixed for CVE-2026-16930
• A security problem was fixed for CVE-2026-17429
• A security problem was fixed for CVE-2026-17063
• A security problem was fixed for CVE-2026-17494
• A security problem was fixed for CVE-2026-16707
• A security problem was fixed for CVE-2026-17100
• A security problem was fixed for CVE-2026-16661
• A security problem was fixed for CVE-2026-17093
• A security problem was fixed for CVE-2026-19234
• A security problem was fixed for CVE-2026-19321

The following fixes are being released to mitigate host network attacks against a partition:

• A security problem was fixed for CVE-2026-18821
• A security problem was fixed for CVE-2026-17028
• A security problem was fixed for CVE-2026-17414

The following fixes are being released to mitigate a guest partition attacking the host firmware/hypervisor:

• A security problem was fixed for CVE-2026-17091
• A security problem was fixed for CVE-2026-17097

Others:

• A security problem was fixed for CVE-2026-4936. A re-IPL of the system is required for the security fix to take effect.
• A security problem was fixed for CVE-2026-4937. The corresponding security bulletin includes additional details on how to complete the mitigation.
• A security problem was fixed for CVE-2026-15961.
• A security problem was fixed for CVE-2026-45447
• A security problem was fixed for CVE-2026-52943, CVE-2026-43373, CVE-2026-43194

• Enhanced Diagnostics were added for NVIDIA SRIOV adapters.
• Support was added for RoCE ethernet adapters - x16 2-port 200 Gb and x16 4-port 25/10/1 Gb.
• Support was added for Samsung PM1753 - 15mm U.2 NVMe SSD.
• Support was added to make Resource Group ID available for performance analysis on IBM i.
• Performance improvements were made for virtual IO.
• Support was added for multi-queue functionality on Virtual Ethernet Adapter (trunk adapter).
• New option (lpar_placement=8) partition attribute was added to optimize the assignment of processors and memory for in-memory DB applications.
• Support was updated for Quantum Safe code.
• Support was added for PCIe3 x8 SAS quad-port 12 Gb tape adapter (FC EJ2B and FC EJ2C; CCIN 57F2) on AIX

System firmware changes that affect all systems

• A problem was fixed for NED24 NVMe and ENZ0 PCIe4 expansion drawers calling out cable or other related hardware in cases such as PCIe link degradation. The System Reference Codes logged can be: SRC B7006AA9. The cable callouts may not have correct part number or serial number information if they were recently replaced and the callouts may include both cables when only one should be called out.
• A problem was fixed which may cause a temporary disruption for virtualized storage IO in VIOS client partitions. The problem can occur when performing a Management Console immediate shutdown or immediate reboot of another VIOS client partition. An EEH event can occur in the VIOS, resulting in the temporary storage IO disruption. This fix allows outstanding IO requests to complete normally during these operations.
• A problem was fixed for potentially incorrect reporting of effective or licensed processors. This problem has a small chance of occurring after renewing or quitting an expired and throttled PEP 2.0 membership. This problem can be avoided by renewing PEP 2.0 memberships before they expire.
• A problem was fixed that caused the first IPL after partition create or inactive LPM of a partition with a minimum affinity score set and more than 64 virtual processors to fail with B2006006 SRC. As a workaround, the partition with the failure can be rebooted.
• A problem was fixed for secure RMC failing to recover from LPAR initialization errors. This may result in HMC error message such as "LPAR_HYP_PIPE_INBAND_RMC_MSG: Invalid Params rc=769". If the initialization with an LPAR fails enough times, a system IPL will be required for secure RMC to successfully initialize for the impacted LPAR.
• A problem was fixed where system ipl may fail with SRC BC56070B instead of rebooting after de-configuring the failing fru.

System firmware changes applicable to all systems

IMPORTANT NOTE: Some of these issues are deferred fixes such that the security issue is not fully mitigated until a re-ipl of the system has been completed

The following fixes are being released to mitigate management network attacks against the service processor:

• A security problem was fixed for CVE-2026-16687
• A security problem was fixed for CVE-2026-16835
• A security problem was fixed for CVE-2026-16832
• A security problem was fixed for CVE-2026-18848
• A security problem was fixed for CVE-2026-16828
• A security problem was fixed for CVE-2026-18681
• A security problem was fixed for CVE-2026-16724

The following fixes are being released to mitigate service processor attacks against the host:

• A security problem was fixed for CVE-2026-16938
• A security problem was fixed for CVE-2026-16933
• A security problem was fixed for CVE-2026-18871
• A security problem was fixed for CVE-2026-16930
• A security problem was fixed for CVE-2026-17429
• A security problem was fixed for CVE-2026-17063
• A security problem was fixed for CVE-2026-17494
• A security problem was fixed for CVE-2026-16707
• A security problem was fixed for CVE-2026-17100
• A security problem was fixed for CVE-2026-16661
• A security problem was fixed for CVE-2026-17093
• A security problem was fixed for CVE-2026-19234
• A security problem was fixed for CVE-2026-19321

The following fixes are being released to mitigate host network attacks against a partition:

• A security problem was fixed for CVE-2026-18821
• A security problem was fixed for CVE-2026-17028
• A security problem was fixed for CVE-2026-17414

The following fixes are being released to mitigate a guest partition attacking the host firmware/hypervisor:

• A security problem was fixed for CVE-2026-17091
• A security problem was fixed for CVE-2026-17097

Others:

• A security problem was fixed for CVE-2026-4936. A re-IPL of the system is required for the security fix to take effect.
• A security problem was fixed for CVE-2026-4937. The corresponding security bulletin includes additional details on how to complete the mitigation.
• A security problem was fixed for CVE-2026-15961.
• A security problem was fixed for CVE-2026-45447
• A security problem was fixed for CVE-2026-52943, CVE-2026-43373, CVE-2026-43194

Impact:  Security  Severity:  SPE

Service pack 1110.30 contains updates for SR-IOV Shared Mode adapters or environments. Applying the update will cause a re-initialization of the SR-IOV adapter environment, causing a brief outage.

Update instructions: 

https://www.ibm.com/docs/en/power11/refcodes?topic=POWER11_0000-REF/p11jak/p11jak_updating_sriov_firmware.html

System Firmware changes that affect all systems

• A security problem was fixed for CVE-2026-11885.
• A security problem was fixed for CVE-2026-4932. A re-IPL of the system is required for the security fix to take effect.
• A problem was fixed related to IBM i tagged loadsource failures generating a platform event log with SRC B200308C. The platform event log has a hardware FRU callout as the first priority FRU callout. The fix changes the SRC B200308C FRU callout list to have an appropriate isolation procedure as the first callout instead of immediately replacing hardware.
• A problem was fixed for a container verification failure seen after a Concurrent Firmware Update was performed due to stale data in the Power Hypervisor. Most likely System Reference Codes logged can be: SRC B7009004. This problem only occurs on systems that have recently performed any cable adapter or PCIe adapter cassette Concurrent Maintenance, and then subsequently performed a Concurrent Firmware Update.
• A problem was fixed for performance degradation of a shared processor partition in a resource group that has been recreated.
• A problem has been fixed when allocating more memory than could be contained in a DCM/Drawer when zero cores were assigned to the partition.
• A problem was fixed for performance degradation, including I/O response time, of shared processor partitions after creating or updating resource groups. If shared processor partitions are experiencing performance degradation following a create or update of a resource group, one of the following can be performed to restore normal performance: 1) Power off all shared processor partitions in the affected resource group. All shared processor partitions must be in the powered off state before powering on any shared processor partitions. 2) Use Live Partition Mobility (LPM) to migrate all shared processor partitions in the affected resource group to another server. All shared processor partitions must be migrated away before migrating any of them back. 3) Reboot the server.
• A problem was fixed where error SRC B181A0F9 was logged.
• A change has been made to make sure REST server is running and responds to redfish interface query.
• A change has been made to remove the ECDHE-RSA-CHACHA20-POLY1305 cipher
• A problem was fixed where the HMC shows a generic error when Invalid Long New Password is set by the user
• A problem was fixed where SRC B1814820 was not being reported as a serviceable error log with predictive severity
• A problem was fixed where in case of specific processor errors, there is a possibility of missing callouts which will prevent the system from deconfiguring the bad hardware and booting back up. The fix is to make sure the right hardware is called out in error scenarios to enable the system to boot back up.
• A problem was fixed where service processor would continuously reboot without any recovery action, if service processor kernel detects repeating error conditions.
• A problem was fixed where the service processor was re-sending the already acknowledged error logs by HMC
• This fix prevents a potential concurrent code update failure scenario which could lead the system to lose redundancy without bringing down the system.
• A problem was fixed for adapters configured in SR-IOV mode where a loss of function is possible and may present the following if virtual functions are assigned to AIX or VIOS partitions: MLXCENT_DEAD_EXIT MLXCENT_DEAD_ENTRY MLXCENT_DEAD_REQ MLXCENT_SW_ERR MLXCENT_TX_ERR. The problem only occurs with the following adapter types: EC2R/#EC2S with CCIN 58FA and #EC2T/#EC2U with CCIN 58FB. The problem occurs for the mentioned adapters when a high volume of network traffic is being transmitted on a virtual function.
• A change was made to how Preventative errors are being flagged.

Impact:  Security  Severity:  HIPER

System Firmware changes that affect all systems

• A security problem was fixed for CVE-2025-38556.
• A security problem was fixed for CVE-2026-22796
• A problem was fixed where, in rare cases, first failure capture data may not be able to be collected from the Virtualization Management Interface or Runtime Processor Diagnostics. The probability of encountering this problem can be reduced by using a 256 MB Logical Memory Block size.
• A problem was fixed for the display of Resource Group information from the Management Console. The problem occurs if any single Resource Group encounters an error during the query process causing the results to contain no information for that Resource Group or any subsequent Resource Groups.
• A problem was fixed where application of an activation CoD key via the service processor's ASMI interface during system IPL could cause a Hypervisor task to fail with an B7000602 SRC. The failed task would block all activation keys from being accepted when applied via ASMI until the system is re-IPL'd.
• A change was made for multiple misleading logs with SRC BA180005, which may be logged when an LPAR is booted. The fix replaces the log with checkpoint CA00E15C, which indicates a boot driver is loaded for an OEM NVMe adapter.
• A problem was fixed for an OS crash that can occur after an LPM. The problem can occur after many iterations of LPM for an LPAR OS that supports an inband HMC to OS communication (RMC Connection).
• A problem was fixed when deleting a resource group. The problem only occurs when dedicated cores are disabled on a system using Power Enterprise Pool 2.0.
• A change was made to enhance the affinity scores generated for Resource Groups.
• A problem was fixed for possible improper placement of partitions during a Dynamic Platform Optimization operation that includes partitions in two or more Resource Groups.
• A problem was fixed where firmware code downgrade may fail with error SRC BD8DC201.
• CVE-2024-13176 is fixed by bumping up the openssl version
• A problem was fixed where FSP may be guarded after the code update and the system failed to boot.
• A problem was fixed where the system will failover and boot all processing units instead of deconfiguring the processing unit and booting from the same FSP.

Impact:  Function  Severity:  SPE

New Features and Functions

• Support was added for PCIe x16 dual monitor graphics adapter (FC EC90).
• Support was enhanced for Link Layer Discovery Protocol (LLDP) capability when an adapter is in SR-IOV shared mode, allowing collection of network topology information via network switches.
• Support was added for Link Layer Discovery Protocol (LLDP) on IBM Power System E1180 (9080-HEU).
• Support was added for ?inband? HMC to OS communication (RMC Connection). This eliminates external network dependencies for RMC for OS versions that are enabled for in-band RMC.
• Support was added for The Linux Integrity Measurement Architecture (IMA). IMA verifies signatures against critical BMC software components, measuring and logging these measurements in the TPM and allowing attestation of these results at runtime.
• Support was added to auto provision vTPM during partition creation, provisioning a signed endorsement key certificate during instantiation to provide that proof of authenticity.

System Firmware changes that affect all systems

• A change was made to support only the following ciphers and remove others: TLS13_AES_128_GCM_SHA256, TLS13_AES_256_GCM_SHA384, TLS13_CHACHA20_POLY1305_SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-ECDSA-CHACHA20-POLY1305, ECDHE-RSA-CHACHA20-POLY130.
• A problem was fixed in the firmware for the IBM Power E1080 and IBM Power E1180 multi-node configuration. The exchange FRU operation fails for a cable card exchange if the selected slot is not on node 0. When this happens, a failure return code of 0x033D is returned after failing to power on the power domain. This problem affects system model E1080 and E1180 only in the multi-node configuration.
• A problem was fixed to prevent FSP from logging an additional unrecoverable SRC B18ABAAB when host terminates.
• A problem was fixed where multiple system dumps were being generated on an error condition, prolonging the time taken for system recovery.
• A problem was fixed where one of the IPL failures now reports the correct SRC B18ABA4E instead of B18A0079.
• A problem was fixed where some systems with large memory configuration took longer to ipl the system.
• A problem was fixed where SRC B181DA62 was incorrectly reported after the primary failing SRCs B181BE14 and BC50240B were reported.
• A problem was fixed where SRC B18ABA40 was seen during the first boot after a cross-release code update or the first boot after a concurrent code update.
• A problem was fixed where SRC B18ABA40 will be reported with appropriate reason for system boot fail.
• A problem was fixed where SRCs B1818601 and B181E911 were reported when host terminates due to an issue.
• A problem was fixed where the service processor kernel storage partition table might not be updated correctly, resulting in a loss of flash redundancy.
• A problem was fixed where the system would failover and boot when SRC BC200D01 is seen instead of booting with deconfigured processing unit.
• A problem was fixed where the system would take 4 hours to identify that host has terminated and then try a reboot to recover.
• Support was added to display a new option in Network configuration menu to configure LLDP for both interfaces in ASMi.
• A problem was fixed to allow the system to attempt to diagnose clocking issues within the redundant clock system that were always flagged as preventative errors that require a technician to come out and check the system. This allows the system to recover gracefully if there is a transient issue in the system, or flag as a preventative error if the issue is not resolved.
• A problem was fixed when removing a system from Power Enterprise Pool 2.0 when there are guarded cores in the system.
• A problem was fixed for a failure or partial completion for a processor config change for a partition. As a workaround, the processor config change can be retried.
• A problem was fixed where B400FF04 SRCs are seen on the system after non-concurrently replacing an SR-IOV adapter while it is in shared mode and has logical ports configured.
• A problem was fixed where the error message "HSCL146A The I/O adapter: null is not valid." may be displayed by the management console when transitioning an SR-IOV adapter from shared to dedicated mode even though the operation was successful.
• The version of OpenSSL used by PowerVM has been updated to OpenSSL 3.0.18.
• A security problem was fixed for CVE-2025-52497 and CVE-2025-49087.
• A security problem was fixed for CVE-2025-36194.
• A security problem was fixed for CVE-2025-36238.
• A change was made to move SR-IOV adapters up to the latest level of adapter firmware. This update contains important reliability enhancements and performance fixes for adapters in promiscuous mode. This change updates the adapter firmware to XX.43.3608 for the following Feature Codes and CCIN: #EC71/EC72 with CCIN 2CF9, #EC75,EC76 with CCIN 2CFB, #EC85,EC86 with CCIN EC2C, and #EN24,EN26 with CCIN EC2A. Applying the update will cause a re-initialization of the specific SR-IOV adapter environment, causing a brief outage. Update instructions: https://www.ibm.com/docs/en/power10?topic=adapters-updating-sr-iov-adapter-firmware.
• A change was made to suppress logging TPM failures with SRC B7009009 during TPM health checks.
• A problem has been fixed where a combination of communication fails to the power IC devices on a DDIMM could result in an IPL crash, with no log indicating which parts caused the fail. This fix will properly call out and deconfigure the failing DDIMM.
• A problem has been fixed to improve the firmware selection of processor cores added to an active dedicated processor partition.
• A problem was fixed for a multi-port adapter failing to configure or encountering performance impacts. The problem only pertains to multi-port adapters in an ENZ0 PCIe4 expansion drawer. The problem does not pertain to adapters running in SR-IOV shared mode. After installing the firmware service pack containing this fix, the partition(s) owning the impacted adapter(s) will need to be rebooted or the adapter(s) will need to be dynamically removed and added back to the partition(s) for the fix to activate for the impacted adapter(s).
• A problem was fixed for a possible system termination with SRC B700F105 after changing the I/O configuration or deleting a partition that is in the failed state with the SRC B2001230.
• A problem was fixed for a possible system termination with SRC B700F105 when running KVM in a PowerVM LPAR.
• A problem was fixed for a system state of incomplete on the management console which is not recoverable with a "Recover system" option of the managed system. The problem occurs when a new partition is created on the system, but the internal representation of the partition is not completed. The fix allows for the system firmware to validate partition creation is complete and will synchronize inconsistencies in the partition representation.
• A problem was fixed for network adapters with Feature Codes EC24/EC26 where traffic loss for SR-IOV logical ports configured on the adapter may occur and SRC B400FF02 platform event log will be created. This problem may intermittently occur when the adapter is configured in shared mode and a manually initiated resource dump is initiated from the HMC or ASMI targeting the adapter.
• A problem was fixed in firmware that prevented the external stand-alone USB DVD (Feature EUA5) from being selected as a boot device via the SMS menu and the SMS macros.
• A problem was fixed in the Power Hypervisor code where resources assigned to Virtual Functions may be deallocated even when there are configured VF resources for partitions. This could happen during hardware repair or replacement (FRU Repair or Exchange) if the VF resources weren?t removed from the operating system before starting the procedure.
• A problem was fixed where a concurrent firmware update would fail and the system would go to Incomplete state on the HMC.
• A problem was fixed that prevented the HMC from displaying daily notifications on the GUI and sending daily email notifications for a system in a Power Enterprise Pool 2.0 (PEP 2.0) whose PEP 2.0 Capacity on Demand code was within 7 days of expiration.
• A problem was fixed to continue to configure all the PCIe Switch slots under a PCIe Switch when one of the slot initialization operations fails under the PCIe Switch. The problem occurs only when there is an issue with one or more slots in IPL under PCIe Switch. This fix is applicable for all PCIe Switches in System Units and in IO Expansion Units.
• A problem was fixed where a B2006002 SRC may be seen when re-IPLing a system with 2 or more SR-IOV adapters in shared mode, even though no adapters were replaced. The failed SR-IOV adapter can be powered on again and it should boot correctly.
• A problem was fixed where a serviceable event for a processor issue was logged with an incorrect call out.
• A problem was fixed where AIX Update Access Key (UAK) expiration HMC notifications are logged along with A7004763 and A7004764 SRCs on IBMi partitions on systems with no AIX LP installed. With the fix, these notices will be suppressed if no AIX partition exists on the system.
• A problem was fixed where booting to the SMS menu and executing a specific SMS key sequence could cause undefined behavior. The problem may occur if a user executes the following key sequence upon boot to the SMS menu: 5 (Select Boot Options) ->1 (Select/Install boot device) ->5 (List all Devices).
• A problem was fixed where firmware might get out of sync after a runtime code update followed by a memory-preserving IPL. The fix addresses the issue and ensures proper security checks pass with the new code.
• A problem was fixed where if all TPM (trusted platform module) hardware has been marked as failed in the hypervisor, the hypervisor will block live partition migrations with the system key and capacity on demand activation codes from being applied.
• A problem was fixed where long running CoD based firmware operations, such as the processing of applied entitlements, may time-out. This results in the server state being set to incomplete on the HMC, which will require a rebuild of the server.
• A problem was fixed where Power Enterprise Pool 2.0 (PEP 2.0) and virtual serial number activation codes applied on the HMC may time-out.
• A problem was fixed where the hypervisor could allow memory to be over-configured on the system, leading to inconsistent memory values and errors on the management console.
• A problem was fixed where the hypervisor was reserving too much memory for SR-IOV adapters that are configured in shared mode. Activating this service pack will automatically resolve the issue and free up memory on the system.
• A problem was fixed where the SMS boot position (index) may not populate properly. SMS options: 5 (Select Boot Options) -> 1 (Select/Install boot device) ->5 (List all Devices). Workaround: SMS options: 5 (Select Boot Options) -> 2 (Configure Boot Device Order) -> [ESC] -> 5 (Select Boot Options) -> 1 (Select/Install boot device) -> 5 (List all Devices).
• A problem was fixed where unnecessary SBE Updates were being performed on Cold IPLs (ie, the system is powered off before IPLing/booting). The solution better determines if a SBE Update is really necessary on a Cold IPL and saves IPL time by bypassing any unnecessary SBE Updates.
• A problem was fixed where preventative errors were being flagged incorrectly and unnecessarily during testing. This fix reconfigures the flags that are set for watching for these preventative errors.
• Added a recovery mechanism to work around hardware erratum on certain PMIC components on certain 4U DDIMMs which would otherwise cause them to reset voltage settings leading the DIMM to run in N-mode until the system reboots.

• A problem was fixed that could cause reduced system performance due to incorrect core state handling on certain processor configurations, including field core override settings and guarded processors.
• A problem was fixed where FSP and proc FN numbers were not getting updated after moving to a transition image.