Threats tagged 'ghsa-rx9m-cwq2-hf3w'

CVE-2026-102916 is a reachable assertion vulnerability in the illumos bhyve instruction emulator that allows a guest VM to cause the host to panic. The issue arises when emulating REP-prefixed MOVS or STOS instructions accessing guest MMIO, where a status flag is not cleared properly, leading to a VERIFY assertion failure and host panic. A privileged user inside a guest VM can exploit this to cause denial of service to the host and all other guests. The flaw has existed since 2020 and affects illumos distributions prior to a specific commit fixing the issue.