CVE-2026-81627 is a high severity (CVSS 8.2) out of bounds write in QEMU. The VAPIC setup hypercall does not keep its writable RAM alias inside the option ROM window, so a privileged guest on a Q35 KVM machine can reach locked SMRAM. Red Hat documents a mitigation; check your distribution for a fixed build.
What's affected
- QEMU on x86 Q35 machine types with KVM acceleration, per the Red Hat entry.
- The record does not list fixed upstream versions, and we did not find one in the sources we read. Check the QEMU issue tracker and your distribution for a fixed package.
- Exploitation requires guest root access and KVM acceleration, according to Red Hat.
Record severity: CVSS 8.2 (high), vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-787, Out-of-bounds Write.
Source note: The record gives CVSS 3.1 of 8.2 and Red Hat lists the same score, but notes its scores are preliminary. The upstream reporter was unsure whether the bug qualifies as a security issue on its own. No fixed upstream version was confirmed.
How to check if you're exposed
Run qemu-system-x86_64 -version on hosts, and virsh dumpxml for a guest to see whether it uses a q35 machine type. Red Hat notes the kvmvapic optimization is normally used only by 32 bit Windows guests, so list those guests. Compare your package version with your distribution security tracker.
What to do now
- Find hosts running QEMU with KVM, and the machine type of each guest.
- Install the distribution update for QEMU when available, and restart guests so they use the new binary.
- As the Red Hat mitigation, disable the VAPIC TPR optimization by preventing the kvmvapic option ROM from loading. With libvirt, set the vapic state to off in the hyperv features of the domain XML. With QEMU directly, pass the global option kvmvapic.rom=off.
- Note that Linux guests, 64 bit Windows guests, and guests using x2APIC or MSR based TPR access are unaffected by disabling it, per Red Hat.
- Limit who holds root inside guests that you do not fully control.
Why it matters
The record classes the flaw as an out of bounds write (CWE-787). A hypercall used by the guest sets up a writable alias of memory, and the code does not check that the alias stays inside the option ROM region. A guest can therefore place it over memory that the chipset has locked, which defeats the lock that guards System Management Mode code.
The score is 8.2 with changed scope because the issue crosses a trust boundary inside the virtual machine. The attacker must already be privileged in the guest. The upstream reporter noted uncertainty about whether it counts as a security issue on its own, so treat it as a hardening priority. The record does not mark it exploited in the wild.
Quick check
Does disabling kvmvapic affect Linux guests?
Red Hat says Linux guests, 64 bit Windows guests, and guests using x2APIC or MSR based TPR access are unaffected.
Is a fixed version known?
We could not confirm one. Check the QEMU tracker and your distribution.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
