CVE-2026-81627

A flaw in QEMU 's VAPIC setup hypercall (hw/i386/vapic.c) fails to validate that the writable RAM alias stays within the option ROM window. A privileged guest on a Q35/KVM machine can position this alias over locked SMRAM , bypassing chipset D_LCK protection and injecting code into System Managem...