CVE-2026-81627

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

This flaw allows a privileged guest to bypass SMRAM locking on Q35 machine types by placing the VAPIC writable ROM alias outside the option-ROM window. While the kvmvapic TPR optimization is normally used only by 32-bit Windows guests, any privileged guest can deliberately invoke the VAPIC setup hypercall to trigger the vulnerable code path. Exploitation requires guest root access and KVM acceleration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The VAPIC TPR optimization can be disabled by preventing the kvmvapic option ROM from loading. When using libvirt, set the following in the guest's domain XML:

<features>
  <apic/>
  <hyperv>
    <vapic state='off'/>
  </hyperv>
</features>

When using QEMU directly, pass -global kvmvapic.rom=off on the command line.

This optimization is only used by 32-bit Windows guests for MMIO-based TPR register access. Linux guests, 64-bit Windows guests, and any guest using x2APIC or MSR-based TPR access are unaffected by disabling it.