CVE-2026-81627

EUVD-2026-82872
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 8.84%
Debian logo
Debian Releases
Debian Product
Codename
qemu
bookworm
vulnerable
bookworm (security)
vulnerable
forky
1:11.1.2+ds-3
fixed
sid
1:11.1.2+ds-3
fixed
trixie
no-dsa
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
qemu
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
stonking
needs-triage
trusty
needs-triage
xenial
needs-triage
qemu-hwe
jammy
dne
noble
dne
resolute
needs-triage
stonking
needs-triage
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ivshmem-tools
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-audio-alsa
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-audio-oss
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-audio-pa
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-audio-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-curl
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-dmg
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-iscsi
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-nfs
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-rbd
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-block-ssh
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-common
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-common-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-debuginfo
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-debugsource
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-docs
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-guest-agent
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-guest-agent-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-img
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-img-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-kvm
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-kvm-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-pr-helper
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-pr-helper-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-aarch64-core-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-system-x86-core-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tests
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tests-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tools
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-tools-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-ui-curses
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-ui-gtk
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-ui-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
qemu-user
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-binfmt
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static
Amazon Linux 2
10:3.1.0-8.amzn2.0.28
fixed
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-aarch64
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-aarch64-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-x86
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
qemu-user-static-x86-debuginfo
Amazon Linux 2023
2:11.0.0-4.amzn2023
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
qemu
Azure Linux 3.0
0:10.1.0-2.azl3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2026-81627
https://bugzilla.redhat.com/show_bug.cgi?id=2536950
https://gitlab.com/qemu-project/qemu/-/work_items/4206
https://gitlab.com/qemu-project/qemu/-/work_items/4206