← Back to CVEs

CVE-2026-29649

CRITICAL

9.8

Description

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1).

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/20/2026

Last Modified4/21/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-693

References

https://docs.riscv.org/reference/isa/priv/hypervisor.html(cve@mitre.org)

https://docs.riscv.org/reference/isa/priv/machine.html(cve@mitre.org)

https://github.com/OpenXiangShan/NEMU/issues/681(cve@mitre.org)

https://github.com/OpenXiangShan/NEMU/pull/689(cve@mitre.org)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.