TI-2026-70046 Aliases CVE-2026-102916 GHSA-rx9m-cwq2-hf3w

Reachable assertion in illumos bhyve lets guest panic host

LOW 29CWE-617Published 2026-10-09 · Updated 2026-10-09

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-617.

Summary

The illumos bhyve instruction emulator is affected in OmniOS and in any illumos distribution prior to illumos-gate commit 696ecf8d. When emulating REP-prefixed MOVS or STOS instructions against kernel-emulated MMIO regions such as the local APIC, the emulator does not clear a repeat status flag on the final iteration, which makes a reachable assertion fail (CWE-617). A privileged user within a guest VM can panic the host and every other guest running on it.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00123 2nd percentileScored 2026-11-07

Fix Fixed OmniOS (OmniOS): r151058w, r151056aw, r151054bw

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OmniOS	OmniOS	any to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bw	r151058w, r151056aw, r151054bw	Patch available	CNA

OmniOS VendorOmniOS Affected any to before r151054; r151058 to before r151058w; r151056 to before r151056aw; r151054 to before r151054bw Fixed in r151058w, r151056aw, r151054bw Patch available CNA

Remediation

Update OmniOS to r151058w for the r151058 branch, r151056aw for the r151056 branch or r151054bw for the r151054 branch. Other illumos distributions should apply illumos-gate commit 696ecf8d.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA OmniOS (OmniOS) Fixed in r151058w, r151056aw, r151054bw

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-09
OmniOS r151054, r151054bw and 2 more versions
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2026-70048 Unreleased file descriptors in illumos nscd exhaust kernel memoryPriority LOW 29
- TI-2026-70051 Stack buffer overflow in illumos reparsed lets local users crash itPriority LOW 23
- TI-2026-70050 NULL pointer dereference in illumos nwamd lets local users crash itPriority LOW 23
Show all 7 records →

Timeline

2026-10-09 Threatist record created from CVE-2026-102916
2026-10-10 Alias added: GHSA-rx9m-cwq2-hf3w

References

Patch 1

https://github.com/illumos/illumos-gate/commit/696ecf8debceed9dc33937d8c8e111e4aeebfdae

Other 2

TI-2012-00210 The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix… CVSS 2.0HIGH 7.2
TI-2021-19340 An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90… CVSS 3.1MEDIUM 5.5
TI-2026-12978 SCTP needs to better-check INIT ACK chunk parameters CVSS 4.0CRITICAL 9.1
TI-2020-16788 An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by… CVSS 3.1CRITICAL 9.8
TI-2016-05624 Improper input validation in illumos osnet-incorporation CVSS 3.0HIGH 8.6
TI-2019-06998 An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other… CVSS 3.1HIGH 8.1

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences