< Back

CVE-2026-81627

Updated on 18 Sep 2026

Severity

8.2 High severity

Details

CVSS score
8.2
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
qemu-kvm @ 10.1.0 (+2 more)