CVE-2026-102916

Name of the Vulnerable Software and Affected Versions illumos versions prior to illumos-gate commit 696ecf8d

Description A reachable assertion in the bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO (Memory-Mapped I/O, a method for the CPU to access hardware devices), the functions vie emulate movs() and vie emulate stos() in usr/src/uts/intel/io/vmm/vmm instruction emul.c fail to clear the VIES REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel, such as the local APIC, I/O APIC, and HPET, this stale flag causes a VERIFY assertion in vie advance pc() to fail, leading to a host panic. A privileged user within a guest VM can trigger this by issuing a REP MOVS or REP STOS instruction against the local APIC page, resulting in a denial of service for the host and all other guests running on it.

Recommendations Update to illumos-gate commit 696ecf8d or a newer version.