CVE-2026-81627

Public on 2026-09-18
Modified on 2026-09-18
Description
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
6.7
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core qemu Pending Fix
Amazon Linux 2023 qemu Pending Fix
Amazon Linux 2027 Preview qemu Not Affected
Amazon Linux 2 - Core qemu-guest-agent Not Affected
Amazon Linux 2 - Core qemu-kvm Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H