Guest-triggered host panic in illumos bhyve emulator
A reachable assertion in the illumos bhyve instruction emulator lets a guest panic the host. When the kernel emulates a REP-prefixed MOVS or STOS that touches guest MMIO, vie_emulate_movs() and vie_emulate_stos() leave the VIES_REPEAT flag set on the last iteration; for kernel-emulated regions (local APIC, I/O APIC, and HPET) that stale flag fails a VERIFY check in vie_advance_pc(). A privileged user inside a guest can aim REP MOVS or REP STOS at the local APIC page and cause a denial of service of the host and every other guest on it. The bug has been present since illumos-gate commit e0c0d44e in 2020 and affects any illumos distribution older than commit 696ecf8d. It is not in CISA KEV, and no public proof-of-concept is known.
What to do: Update illumos-gate to commit 696ecf8d or later, or install the corresponding illumos distribution update that includes that fix, on every bhyve host. Until patched, do not run untrusted guests and limit who can execute privileged code inside VMs, because a guest administrator can panic the host. After patching, reboot hosts so the corrected VMM emulator is loaded.
| illumos-gate (bhyve / vmm instruction emulator) | Builds containing commit e0c0d44e (introduced 2020) and earlier than the fix in commit 696ecf8d |
| illumos distributions illumos-based distributions shipping the affected bhyve/vmm code | Any distribution build based on illumos-gate prior to commit 696ecf8d |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.
illumos disclosed CVE-2026-102916, a bhyve REP-prefix emulation bug that mishandles CPU flags.
illumos security reported CVE-2026-102916, internal bug 18491, in the bhyve virtual machine monitor. REP-prefix instruction emulation mishandles CPU flags. Emily Albini of Oxide Computer discovered the flaw, and iximeow of Oxide Computer fixed it. The notice does not describe exploitation in the wild.