CVE-2026-81627

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description A flaw exists in the VAPIC setup hypercall within hw/i386/vapic.c that fails to validate whether the writable RAM alias stays within the option ROM window. A privileged guest user on a Q35/KVM machine can exploit this to position the alias over locked SMRAM, bypassing chipset D LCK protection and injecting code into System Management Mode (SMM) memory. SMM is a highly privileged execution mode in x86 CPUs used for low-level hardware control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.