CVE-2026-102916: CWE-617 Reachable Assertion in illumos illumos-gate

The vulnerability exists in the illumos bhyve instruction emulator's handling of REP-prefixed MOVS and STOS instructions accessing guest MMIO regions such as the local APIC, I/O APIC, and HPET. Specifically, the functions vie_emulate_movs() and vie_emulate_stos() fail to clear the VIES_REPEAT status flag on the final iteration, causing a stale flag to trigger a VERIFY assertion failure in vie_advance_pc(). This results in a host panic, effectively a denial of service. The flaw has been present since 2020 (illumos-gate commit e0c0d44e) and affects all illumos distributions before commit 696ecf8d.

A privileged user inside a guest VM can exploit this vulnerability by issuing REP MOVS or REP STOS instructions targeting the local APIC page, causing the host system to panic. This leads to a denial of service affecting the host and all other guest VMs running on it. The vulnerability does not allow privilege escalation or code execution outside the described denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in illumos-gate commit 696ecf8d, updating to this commit or later versions is recommended once available. Until patched, restrict privileged user access within guest VMs to prevent exploitation.