CVE-2026-81627: Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code into System Management Mode memory.
Other sources
A flaw was found in QEMU's VAPIC (Virtual Advanced Programmable Interrupt Controller) implementation in hw/i386/vapic.c. The 16-bit VAPIC setup hypercall allows a privileged guest to specify both the base address and size of a high-priority writable RAM alias. QEMU does not validate that this alias remains within the VAPIC option ROM boundaries (0xc0000..0xdffff). A malicious guest administrator can place the alias over 0xa0000..0xbffff, bypassing the Q35 chipset's DLCK-protected SMRAM and modifying memory that executes in System Management Mode. This could allow a privileged guest user to inject arbitrary code into locked SMRAM.
Upstream fix: https://gitlab.com/qemu-project/qemu/-/commit/d61c8a6fb7388486353aa267ba0d75b098f16662
Reference: https://gitlab.com/qemu-project/qemu/-/workitems/4206
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
The issue affects Q35/KVM virtual machines using QEMU's VAPIC implementation. Exploitation is performed from inside a guest; it is not described as a remote or unauthenticated attack.
What level of guest access does an attacker need?
An attacker needs privileged access within the guest, such as a guest administrator. They must be able to invoke the 16-bit VAPIC setup hypercall and supply the alias base address and size.
What is the impact if exploitation succeeds?
A privileged guest user can create a writable RAM alias over the 0xa0000..0xbffff SMRAM region, bypassing Q35 D_LCK protection. This can allow modification of locked SMRAM and injection of arbitrary code that executes in System Management Mode.
Is there an upstream fix available?
Yes. The provided upstream fix is commit d61c8a6fb7388486353aa267ba0d75b098f16662 in the QEMU project.