What’s Vulnerable › Vulnerabilities

CVE-2026-81627: Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-10-30
• Weakness: CWE-787

Description

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions
• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions
• Red Hat OpenShift Container Platform 5: all versions
• Red Hat OpenStack Platform 13 (Queens): all versions

References

• https://access.redhat.com/security/cve/CVE-2026-81627
• https://bugzilla.redhat.com/show_bug.cgi?id=2536950
• https://gitlab.com/qemu-project/qemu/-/work_items/4206
• https://gitlab.com/qemu-project/qemu/-/work_items/4206

Get alerted when CVE-2026-81627 or the next vulnerability affects your stack