IBM AIX: security fixes, iFixes and Technology Levels

Updated November 2026

On AIX, a security fix usually arrives first as an interim fix (iFix) that you install with emgr, and later inside a Service Pack. Check your level with oslevel -s, run IBM's FLRTVC script to list missing security fixes, install the iFixes, and keep each server on a Technology Level that IBM still supports.

Supported levels

AIX has three layers: the release (7.2, 7.3), the Technology Level (TL, new features about once a year) and the Service Pack (SP, fixes for one TL). IBM creates Service Packs and interim fixes for a TL until its End of Fix Support (EoFS) date, which is about three years after the TL was released. After EoFS, IBM makes no new fixes for that TL, even if the release itself is still supported.

AIX Technology Levels with fix support (as of November 2026)
TLReleasedLatest SPEnd of Fix Support
AIX 7.3 TL4December 20257300-04-02-2633December 31, 2028
AIX 7.3 TL3December 20247300-03-03-2633December 31, 2027
AIX 7.3 TL2November 20237300-02-05-2633November 30, 2026
AIX 7.2 TL5November 20207200-05-13-2633Not yet set by IBM

IBM's AIX lifecycle page lists the next Service Packs as December 4, 2026 for 7.2 TL5 and February 26, 2027 for 7.3 TL4. All other TLs of 7.2 and 7.3 are past EoFS. IBM's product lifecycle data shows no end-of-support date yet for AIX 7.2 or 7.3 as releases. AIX 7.1 ended standard support on April 30, 2023; IBM lists paid extended support for it until April 30, 2027.

7.3 TL2 ends this month. Fix support for AIX 7.3 TL2 ends on November 30, 2026. After that, new security problems in TL2 get no iFix. Move to TL3 or TL4.

Check your level

oslevel -s
emgr -l

oslevel -s prints a string such as 7300-03-03-2633: 7300 is AIX 7.3, the next 03 is TL3, the next 03 is Service Pack 3, and 2633 is the build. emgr -l lists the interim fixes installed on top. Filesets locked by an iFix show as EFIXLOCKED in lslpp output.

Find missing security fixes

FLRTVC (Fix Level Recommendation Tool Vulnerability Checker) is a ksh93 script from IBM. It compares your installed filesets and iFixes with IBM's list of security and HIPER (high-impact) APARs and prints each fix you still need, with links to the bulletin and the fix. Download it from the FLRT site, then run as root:

lslpp -Lcq > /tmp/lslpp.txt
emgr -lv3 > /tmp/emgr.txt
ksh93 ./flrtvc.ksh -l /tmp/lslpp.txt -e /tmp/emgr.txt -t sec -v

-t sec limits the report to security APARs (-t hiper for HIPER fixes) and -v gives the full report. By default the script downloads IBM's current apar.csv. If the server has no internet access, download that file elsewhere and pass it with -f /path/apar.csv, or use a proxy with -r. Since version 0.7 it lists only unfixed problems; add -a to see fixed ones too.

Apply security fixes now

Interim fixes with emgr

Each IBM security bulletin names the iFix for each affected TL and SP. The packages (.epkg.Z files in a tar archive, with a signed advisory) are also published in IBM's AIX security fix directory. As root, preview and then install:

emgr -p -e /tmp/fix/fixname.epkg.Z
emgr -X -e /tmp/fix/fixname.epkg.Z
emgr -l

-p runs all checks without changing anything. -X expands file systems if space runs short. To remove an iFix, use emgr -r -L label with the label shown by emgr -l. You normally remove an iFix before applying the Service Pack that contains the same fix, because the iFix locks the filesets it changed.

Restart or reboot. A program or library changed by an iFix is not used by a running process until that process restarts, so restart the affected daemons (for example stopsrc -s sshd then startsrc -s sshd). Kernel iFixes need a reboot; emgr marks them as REBOOT_REQUIRED and runs bosboot for you.

Service Packs with SUMA

SUMA downloads updates from IBM. As root, preview and download the latest Service Pack for your current TL:

suma -x -a Action=Preview -a RqType=Latest
suma -x -a Action=Download -a RqType=Latest -a DLTarget=/export/aix/latest

With RqType=Latest, SUMA picks the newest SP for the TL in FilterML, or for the TL reported by oslevel -r if FilterML is not set. To fetch a specific level, use -a RqType=SP -a RqName=7300-04-02 or -a RqType=TL -a RqName=7300-04. You can also download Service Packs and TLs by hand from IBM Fix Central.

Install the updates

Take a mksysb backup first. Then, as root:

install_all_updates -d /export/aix/latest -p
install_all_updates -d /export/aix/latest -Y
oslevel -s

The first line is a preview. The second applies updates to installed filesets only and accepts the licenses. Updates stay applied but not committed, so you can still reject them; installp -s lists them, and installp -c all commits them once you are happy. install_all_updates handles RPM images only if you add -r. Plan a reboot after a Service Pack or TL update (shutdown -Fr restarts the server), because a new kernel is used only after reboot.

Live Update

From AIX 7.2, Live Update applies kernel fixes without a restart: workloads keep running. From 7200-01 it can also apply Service Packs and TLs. You must prepare the /var/adm/ras/liveupdate/lvupdate.data file before the first run. Only iFixes marked as Live Update capable qualify. As root:

geninstall -k -p -d /tmp IJ12345.epkg.Z
geninstall -k -d /tmp IJ12345.epkg.Z

The first line is a preview. To apply all updates and iFixes in a directory, use geninstall -k -d /tmp/source all.

Automatic checks

AIX does not install updates on its own. Automate the checks instead:

Where advisories are published

For reading a bulletin quickly, see Security advisories.

On an unsupported level

If your TL is past EoFS, IBM still answers usage questions until the release reaches end of support, but it creates no new SPs or iFixes for that TL. Update to a supported TL of the same release with SUMA (RqType=TL) and install_all_updates, then reboot. On AIX 7.1, buy IBM's service extension if you need fixes while you migrate, and plan the move to 7.3 before April 30, 2027. More on planning in Is my OS supported?.

Sources