CVE-2026-102916: illumos illumos-gate Reachable Assertion

Vulnerability summary

CVE-2026-102916 is a medium (CVSS 6.8) Reachable Assertion vulnerability in illumos illumos-gate. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.9% of scored vulnerabilities.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 09-10-2026
   Last modifiedVulnerability information updated.

Description

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.

• CWE-617Reachable AssertionThe product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.