1 mentions in 7 days · 1 in 30 days · 2 total · first seen · last
illumos disclosed CVE-2026-102916, a bhyve REP-prefix emulation bug that mishandles CPU flags.
illumos security reported CVE-2026-102916, internal bug 18491, in the bhyve virtual machine monitor. REP-prefix instruction emulation mishandles CPU flags. Emily Albini of Oxide Computer discovered the flaw, and iximeow of Oxide Computer fixed it. The notice does not describe exploitation in the wild.
Oxide's RFD 0301 proposes a rack-level key hierarchy using Shamir secret sharing and a trust quorum to protect data-at-rest keys.
Oxide's request for discussion (RFD 0301) lays out a key-hierarchy strategy for rack-level security, deriving keys from a rack secret protected by Shamir secret sharing across a trust quorum of sleds, with keys exchanged over authenticated sprockets sessions. The document maps which keys protect control-plane data, metrics, Crucible extents, and authentication tokens, and defines open questions on key lifecycle, locality, and compromise handling. Future work includes sealing shares with the root of trust so an attacker would need to steal K whole sleds to reconstruct the rack secret.