{"id":"CVE-2026-102916","summary":"Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host","details":"A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.","modified":"2026-10-10T13:03:08.514453086Z","published":"2026-10-09T14:12:08.832Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102916.json","unresolved_ranges":[{"extracted_events":[{"introduced":"r151058"},{"fixed":"r151058w"},{"introduced":"r151056"},{"fixed":"r151056aw"},{"introduced":"r151054"},{"fixed":"r151054bw"},{"introduced":"any"},{"fixed":"r151054"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"illumos","cwe_ids":["CWE-617"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/09/19"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102916.json"},{"type":"PACKAGE","url":"https://github.com/illumos/illumos-gate"},{"type":"FIX","url":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae"},{"type":"WEB","url":"https://illumos.org"},{"type":"REPORT","url":"https://illumos.org/issues/18491"},{"type":"ARTICLE","url":"https://illumos.topicbox.com/groups/developer/T697a32b688807e56/cve-2026-102916-18491-bhyve-rep-prefix-instr-emulation-fumbles-flags"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102916"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/illumos/illumos-gate","events":[{"introduced":"e0c0d44e917080841514d0dd031a696c74e8c435"},{"fixed":"696ecf8debceed9dc33937d8c8e111e4aeebfdae"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102916.json","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c","function":"vie_repeat"},"deprecated":false,"digest":{"function_hash":"138351732154124372146279712813651807595","length":375},"id":"CVE-2026-102916-06565205"},{"source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c","function":"vie_emulate_movs"},"deprecated":false,"digest":{"function_hash":"203139652492712269837801247151270921254","length":3159},"id":"CVE-2026-102916-3d77a5ae","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c","function":"vie_emulate_inout"},"deprecated":false,"digest":{"function_hash":"252691118131673821220664317973416956601","length":766},"id":"CVE-2026-102916-5f60aa6d","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c"},"deprecated":false,"digest":{"line_hashes":["136796085951978741535069544553419698320","267439305370731782160439102294402929572","261175422774861482744705937733917681000","218957214876631091063333302210279801010","182207030742697431890222412821475545093","191894966831718677012095835857887828528","216182269623667000284190613575166644547","321807369927340566181377463918873809181","168760005760063954501581919971451144702","274380611010740469456337589921138483482","152148047916811166016124871432580355530","65308840927206698231395823642901490813","149196496880096006172660458389057033165","53501788261971114455426510639732409705","269985496494159850818647852486879080069","298368606420512124208461464223076478016","103599451275307572568194045784434737977","114222252627381045391645277636798007844","53878997238634312017731329105568293302","82985191342745650410278449049607216155","189511973379669604525923598950649191836","65308840927206698231395823642901490813","149196496880096006172660458389057033165","53501788261971114455426510639732409705","67698431495982916724728549145016703764","217856955903431545347355023431310181845","101465411393571176717531996332348657883","308961618999873073889107919771055369718","3394208066017679698741375121064486591","142395099549514184749805996333960855493","214719727258534222341612214284015226510","11201715937432538894521492511320085684","132333380885903015363271254367871317948","217654426020615392567541219692589504872","154374705379418918286386294702392340812","276453098857417916443303276784758600772","184204927920102689773321093373248696744","45123520743194980694586500608592118117","123837696168568330161691739486018649567","233170335581152829295114831684858657726","119763045306120225431678406865469607568","136831866702787778269272248965493298789","135518496063269212334760585863182638962","142568098423309446996468229302310050109","313244660038395130310969666953983153568","317577889740084705277222145625975159405","83193582443683271978434305795513119610","195039057743022032094632073274257093281","191463164773907178563445067296555757978","173622156724300527296305437216735885316","36082839819970512350424216261050138211","182171778693187731826150254494644921016","10732811537509319324310302105549885138","261084130169052438213962966329224810187","308452871583535163917295983609487474143","23440656440087404597043026735932123226","331248283286345993064022931650390528664","54618076263867381976560416720001151658","67287697159659228670415610121869927037","182776338885737986803505231813003032696","60428524564902591338913041694590409327","60598443889342899472364648527849344885"],"threshold":0.9},"id":"CVE-2026-102916-6afd8a60","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-102916-98dcc59e","signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"function":"vie_emulate_inout_str","file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c"},"deprecated":false,"digest":{"function_hash":"219294811401239834569178284869431191658","length":1891}},{"source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c","function":"vie_emulate_stos"},"deprecated":false,"digest":{"length":1469,"function_hash":"217369716271478022780500308182177427106"},"id":"CVE-2026-102916-acd83385","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","target":{"function":"vie_init_inout","file":"usr/src/uts/intel/io/vmm/vmm_instruction_emul.c"},"deprecated":false,"digest":{"function_hash":"320157734223100271445274201390756210785","length":320},"id":"CVE-2026-102916-e3e1a336"}],"vanir_signatures_modified":"2026-10-10T13:03:08Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/AU:Y/R:A/V:C"}]}