CVE-2026-102916: rep prefix emulation flaw in illumos bhyve

What happened and what to do

On 9 October 2026, illumos disclosed CVE-2026-102916, related to bhyve, the virtualization component of VMM. The advisory, published by Dan McDonald on behalf of the illumos security team and forwarded to the oss-sec list, states that rep prefix instruction emulation mishandles flags. The flaw was discovered by Emily Albini and fixed by iximeow, both of Oxide Computer.

In practice, a company running virtual machines on illumos-based systems or derived distributions should inventory where bhyve is in use, verify that packages have been updated with the fix, and record the applied version on each host. A simple version-collection pipeline, with alerts when a host falls behind the patch, shortens exposure time without relying on manual checks. It is also worth testing the fixes in a staging environment with real workloads before applying them to production.

How the consultancy can help

We can diagnose a virtualization estate that uses bhyve or VMM, mapping hosts, versions and update dependencies. We then design and implement version monitoring with alerts and a staging workflow to apply fixes with traceability, all on the client's infrastructure.

Next step

If your company uses illumos or derived distributions with bhyve, send a short description of the environment and your current update process. You will receive a scoped proposal for diagnosis and implementation.