CVE-2026-102916
- Source
- https://cve.org/CVERecord?id=CVE-2026-102916
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102916.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-102916
- Published
- 2026-10-09T14:12:08Z
- Modified
- 2026-10-10T13:03:08Z
- Severity
-
- 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/AU:Y/R:A/V:C CVSS Calculator
- Summary
- Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
- Details
-
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.
- Database specific
{ "cna_assigner": "illumos", "cwe_ids": [ "CWE-617" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102916.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "r151058" }, { "fixed": "r151058w" }, { "introduced": "r151056" }, { "fixed": "r151056aw" }, { "introduced": "r151054" }, { "fixed": "r151054bw" }, { "introduced": "any" }, { "fixed": "r151054" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- http://www.openwall.com/lists/oss-security/2026/10/09/19
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102916.json
- https://github.com/illumos/illumos-gate
- https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae
- https://illumos.org
- https://illumos.org/issues/18491
- https://illumos.topicbox.com/groups/developer/T697a32b688807e56/cve-2026-102916-18491-bhyve-rep-prefix-instr-emulation-fumbles-flags
- https://nvd.nist.gov/vuln/detail/CVE-2026-102916
Affected packages
Git / github.com/illumos/illumos-gate
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102916.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "138351732154124372146279712813651807595",
"length": 375
},
"id": "CVE-2026-102916-06565205",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_repeat"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203139652492712269837801247151270921254",
"length": 3159
},
"id": "CVE-2026-102916-3d77a5ae",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_emulate_movs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "252691118131673821220664317973416956601",
"length": 766
},
"id": "CVE-2026-102916-5f60aa6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_emulate_inout"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"136796085951978741535069544553419698320",
"267439305370731782160439102294402929572",
"261175422774861482744705937733917681000",
"218957214876631091063333302210279801010",
"182207030742697431890222412821475545093",
"191894966831718677012095835857887828528",
"216182269623667000284190613575166644547",
"321807369927340566181377463918873809181",
"168760005760063954501581919971451144702",
"274380611010740469456337589921138483482",
"152148047916811166016124871432580355530",
"65308840927206698231395823642901490813",
"149196496880096006172660458389057033165",
"53501788261971114455426510639732409705",
"269985496494159850818647852486879080069",
"298368606420512124208461464223076478016",
"103599451275307572568194045784434737977",
"114222252627381045391645277636798007844",
"53878997238634312017731329105568293302",
"82985191342745650410278449049607216155",
"189511973379669604525923598950649191836",
"65308840927206698231395823642901490813",
"149196496880096006172660458389057033165",
"53501788261971114455426510639732409705",
"67698431495982916724728549145016703764",
"217856955903431545347355023431310181845",
"101465411393571176717531996332348657883",
"308961618999873073889107919771055369718",
"3394208066017679698741375121064486591",
"142395099549514184749805996333960855493",
"214719727258534222341612214284015226510",
"11201715937432538894521492511320085684",
"132333380885903015363271254367871317948",
"217654426020615392567541219692589504872",
"154374705379418918286386294702392340812",
"276453098857417916443303276784758600772",
"184204927920102689773321093373248696744",
"45123520743194980694586500608592118117",
"123837696168568330161691739486018649567",
"233170335581152829295114831684858657726",
"119763045306120225431678406865469607568",
"136831866702787778269272248965493298789",
"135518496063269212334760585863182638962",
"142568098423309446996468229302310050109",
"313244660038395130310969666953983153568",
"317577889740084705277222145625975159405",
"83193582443683271978434305795513119610",
"195039057743022032094632073274257093281",
"191463164773907178563445067296555757978",
"173622156724300527296305437216735885316",
"36082839819970512350424216261050138211",
"182171778693187731826150254494644921016",
"10732811537509319324310302105549885138",
"261084130169052438213962966329224810187",
"308452871583535163917295983609487474143",
"23440656440087404597043026735932123226",
"331248283286345993064022931650390528664",
"54618076263867381976560416720001151658",
"67287697159659228670415610121869927037",
"182776338885737986803505231813003032696",
"60428524564902591338913041694590409327",
"60598443889342899472364648527849344885"
],
"threshold": 0.9
},
"id": "CVE-2026-102916-6afd8a60",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "219294811401239834569178284869431191658",
"length": 1891
},
"id": "CVE-2026-102916-98dcc59e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_emulate_inout_str"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "217369716271478022780500308182177427106",
"length": 1469
},
"id": "CVE-2026-102916-acd83385",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_emulate_stos"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "320157734223100271445274201390756210785",
"length": 320
},
"id": "CVE-2026-102916-e3e1a336",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae",
"target": {
"file": "usr/src/uts/intel/io/vmm/vmm_instruction_emul.c",
"function": "vie_init_inout"
}
}
]
vanir_signatures_modified
"2026-10-10T13:03:08Z"