CVE-2026-102916: Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs() and vieemulatestos() in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vieadvancepc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 696ecf8d
Event History
Frequently Asked Questions
Which environments are exposed?
The issue affects illumos bhyve hosts running code prior to illumos-gate commit 696ecf8d. The triggering access must target MMIO emulated in the kernel, including the local APIC, I/O APIC, or HPET.
What level of access does an attacker need?
An attacker needs privileged access within a guest VM. They can use a REP MOVS or REP STOS instruction directed at the local APIC page to trigger the host panic.
What is the operational impact if exploitation succeeds?
The host panics, causing denial of service for the host and every other guest running on it.
How can I determine whether a host is affected?
Check whether the illumos source or distribution build includes illumos-gate commit 696ecf8d. Builds based on code before that commit are affected; the flaw existed since commit e0c0d44e in 2020.