CVE-2026-102916
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
illumos-gate
- Vendor
- illumos
- Product
- illumos-gate
- Platforms
- x86
- Default status
affected- Package
- system/bhyve
- Package collection
- https://illumos.org
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| e0c0d44e917080841514d0dd031a696c74e8c435 | affected | git | 696ecf8debceed9dc33937d8c8e111e4aeebfdae | Unavailable |
|
OmniOS
- Vendor
- OmniOS
- Product
- OmniOS
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| any | affected | custom | r151054 | Unavailable | None listed |
| r151058 | affected | custom | r151058w | Unavailable |
|
| r151056 | affected | custom | r151056aw | Unavailable |
|
| r151054 | affected | custom | r151054bw | Unavailable |
|