CVE-2026-102916
Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
Description
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.
INFO
Published Date :
Oct. 9, 2026, 2:12 p.m.
Last Modified :
Oct. 9, 2026, 2:13 p.m.
Remotely Exploit :
No
Source :
illumos
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 4.0 | MEDIUM | 0ca53633-f0b5-4853-ba72-e0a2e62000d0 |
Solution
- Update illumos to a version after commit 696ecf8d.
- Apply any available patches for the instruction emulator.
- Verify the VIES_REPEAT status flag is handled correctly.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-102916 vulnerability anywhere in the article.