CVE-2026-81627
Fixed in a distro release EPSS <1%CVSS 8.2
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux for NVIDIA 26, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 13 (Queens)
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | no fix |
| Debian 13 | qemu | no fix |
| Debian 14 | qemu | 1:11.1.2+ds-1 |
| SUSE Linux Enterprise Server 16.0 | qemu | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qemu | 10.0.13-160000.2.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| SUSE Linux Micro 6.2 | qemu | 10.0.13-160000.2.1 |
| Ubuntu 22.04 LTS | qemu | no fix |
| Ubuntu 24.04 LTS | qemu | no fix |
| Ubuntu 26.04 LTS | qemu | no fix |
| Ubuntu 26.04 LTS | qemu-hwe | no fix |
| Ubuntu 26.10 | qemu | no fix |
| Ubuntu 26.10 | qemu-hwe | no fix |
| Ubuntu Pro 14.04 LTS | qemu | no fix |
| Ubuntu Pro 16.04 LTS | qemu | no fix |
| Ubuntu Pro 18.04 LTS | qemu | no fix |
| Ubuntu Pro 20.04 LTS | qemu | no fix |
| openSUSE Leap 16.0 | qemu | 10.0.13-160000.2.1 |
| openSUSE Leap 16.0 | qemu-linux-user | 10.0.13-160000.2.1 |
| openSUSE Tumbleweed | qemu | 11.1.1-2.1 |