CVE-2026-81627 PUBLISHED

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

Assigner: redhat
Reserved: 27.08.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Product Status

Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 6
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 7
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux for NVIDIA 26
Versions Default: unknown
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 13 (Queens)
Versions Default: affected

Workarounds

The VAPIC TPR optimization can be disabled by preventing the kvmvapic option ROM from loading. When using libvirt, set the following in the guest's domain XML: <features> <apic/> <hyperv> <vapic state='off'/> </hyperv> </features> When using QEMU directly, pass -global kvmvapic.rom=off on the command line.

This optimization is only used by 32-bit Windows guests for MMIO-based TPR register access. Linux guests, 64-bit Windows guests, and any guest using x2APIC or MSR-based TPR access are unaffected by disabling it.

Credits

  • Red Hat would like to thank Artem Dinaburg (Trail of Bits) for reporting this issue.

References

Problem Types

  • Out-of-bounds Write CWE