{"schema":"threatline.record/2","record":{"id":"CVE-2026-102916","aliases":[],"summary":"Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host","details":"A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.","categories":["Unclassified"],"product":"illumos-gate","vendor":"illumos","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102916","source_modified_at":"2026-10-09T21:07:26.509Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"illumos-gate","vendor":"illumos","versions":[{"status":"affected","version":"e0c0d44e917080841514d0dd031a696c74e8c435","lessThan":"696ecf8debceed9dc33937d8c8e111e4aeebfdae","changes":[{"at":"696ecf8debceed9dc33937d8c8e111e4aeebfdae","status":"unaffected"}],"versionType":"git"}],"defaultStatus":"affected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102916","source_modified_at":"2026-10-09T21:07:26.509Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"OmniOS","vendor":"OmniOS","versions":[{"status":"affected","version":"any","lessThan":"r151054","versionType":"custom"},{"status":"affected","version":"r151058","lessThan":"r151058w","changes":[{"at":"r151058w","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151056","lessThan":"r151056aw","changes":[{"at":"r151056aw","status":"unaffected"}],"versionType":"custom"},{"status":"affected","version":"r151054","lessThan":"r151054bw","changes":[{"at":"r151054bw","status":"unaffected"}],"versionType":"custom"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102916","source_modified_at":"2026-10-09T21:07:26.509Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"illumos-gate","ecosystem":null},"version":"696ecf8debceed9dc33937d8c8e111e4aeebfdae","basis":"first unaffected version stated in the CVE record"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00123,"percentile":0.01923,"score_date":"2026-10-23"},"published_at":"2026-10-09T14:12:08.832Z","modified_at":"2026-10-09T21:07:26.509Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-102916","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-09T21:07:26.509Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102916","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://illumos.topicbox.com/groups/developer/T697a32b688807e56/cve-2026-102916-18491-bhyve-rep-prefix-instr-emulation-fumbles-flags","tags":["mailing-list"]},{"source":"CVE List","url":"https://illumos.org/issues/18491","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-09T16:15:23.994154Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T21:07:26.509Z","content_hash":"77c7a0beca5c789d85f62feea4334a33e010ece39da15ca0dd47a19323d952aa"}}