CVE-2026-81627

Summary

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-787: Out-of-bounds Write

Workarounds

The VAPIC TPR optimization can be disabled by preventing the kvmvapic option ROM from loading. When using libvirt, set the following in the guest's domain XML:

<features>
  <apic/>
  <hyperv>
    <vapic state='off'/>
  </hyperv>
</features>

When using QEMU directly, pass -global kvmvapic.rom=off on the command line.

This optimization is only used by 32-bit Windows guests for MMIO-based TPR register access. Linux guests, 64-bit Windows guests, and any guest using x2APIC or MSR-based TPR access are unaffected by disabling it.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

Additional References

References