Medium 6.8Published Oct 9, 2026

CVE-2026-102916Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host

Updated under an hour ago (2026-10-19 08:23 UTC)

Does this affect you?

It affects illumos-gate and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for illumos-gate

Exploited in the last 30 days

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.

CVSS: 6.8 MEDIUM (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/AU:Y/R:A/V:C
Weakness (CWE): CWE-617
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: illumos
NVD analysis: Awaiting Analysis
Record last updated: Oct 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

illumos illumos-gate illumos:gate (from the name)	from e0c0d44e917080841514d0dd031a696c74e8c435 before 696ecf8debceed9dc33937d8c8e111e4aeebfdae; fixed at 696ecf8debceed9dc33937d8c8e111e4aeebfdae	CNA record
OmniOS OmniOS omnios:omnios (from the name)	from any before r151054; from r151058 before r151058w; fixed at r151058w; from r151056 before r151056aw; fixed at r151056aw; from r151054 before r151054bw; fixed at r151054bw	CNA record

References

https://illumos.topicbox.com/groups/developer/T697a32b688807e56/cve-2026-102916-18491-bhyve-rep-prefix-instr-emulation-fumbles-flagsmailing-list
https://illumos.org/issues/18491issue-tracking
https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdaepatch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.