illumos bhyve CVE-2026-102916

Requires an attacker who already has privileged (kernel/ring-0 level) code execution inside a guest VM running under the illumos bhyve hypervisor - i.e., the ability to execute arbitrary machine instructions, consistent with PR:L. The attacker must execute a REP-prefixed MOVS or STOS instruction whose target address falls within an MMIO region emulated inside the host kernel - specifically the local APIC, I/O APIC, or HPET (the reproducer uses the xAPIC page via MSR_APICBASE). No special or non-default bhyve configuration is needed, since in-kernel local APIC emulation is the default. Limiting factors: the vulnerability is local to the guest (no network reachability), requires the ability to run privileged instructions inside the guest rather than mere unprivileged guest access, only affects illumos-derived distributions (illumos-gate, OmniOS) built before fixing commit 696ecf8d, and yields only a host crash (recoverable on reboot) - no code execution, privilege escalation, or data disclosure.

This is a genuine but bounded risk: a guest-to-host denial-of-service in the illumos bhyve instruction emulator. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) and the official score of 6.8 (Medium) align with the description - exploitation is local to a guest VM, requires low complexity, needs some privilege inside the guest (PR:L), and needs no user interaction. The impact signals are consistent and notable: VA:H plus SA:H (subsequent-system availability High) correctly captures that a single guest can crash the host and thereby every co-resident guest, a cross-boundary blast radius that the raw Medium score understates for multi-tenant operators. Exploit maturity in the input is E:P (Proof-of-Concept), and the vendor patch itself ships a regression test (payload_rep_instrs.S / rep_instrs.c) that deterministically reproduces the panic by issuing REP MOVSL/STOSB against the xAPIC page - so a working reproducer is effectively public even though no NVD/CISA POC flag is set. The vulnerability is NOT in CISA KEV and there is no evidence of active exploitation; the AU:Y (automatable) and R:A (automatic recovery, i.e., the host reboots) modifiers suggest a disruptive-but-recoverable crash rather than a persistent compromise. Confidentiality and integrity are untouched (VC:N/VI:N, C:N/I:N) - this is purely availability. Net: a real priority for anyone running untrusted or multi-tenant bhyve guests on illumos/OmniOS, but materially de-prioritized for single-tenant or trusted-guest deployments because it grants no code execution or data access, only a host crash triggerable by an already-privileged guest user.

A privileged (e.g., root/kernel-level) user inside an illumos bhyve guest executes a REP-prefixed MOVS or STOS instruction targeting the in-kernel-emulated local APIC MMIO page. On the final iteration the emulator fails to clear the VIES_REPEAT flag, tripping a VERIFY assertion in vie_advance_pc() and panicking the host, taking down the hypervisor and all co-tenant guests. The vendor patch includes a regression test that reproduces this, so a reliable reproducer is effectively public.