CVE-2026-102916

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...

CVE-2026-102916 Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...

CVE-2026-102916

The illumos bhyve instruction emulator contains a reachable assertion vulnerability in the emulation of REP-prefixed MOVS and STOS instructions. Specifically, the functions vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c fail to clear the VIES_REPEAT s...

EUVD-2026-95796

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vieemulatemovs and vieemulatestos in usr/src/uts/intel/io/vmm/vmminstructionemul.c do not clear the VIESREPEAT status...