CVE-2026-29649

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1).

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.riscv.org/reference/isa/priv/hypervisor.html	Product
https://docs.riscv.org/reference/isa/priv/machine.html	Product
https://github.com/OpenXiangShan/NEMU/issues/681	Issue Tracking
https://github.com/OpenXiangShan/NEMU/pull/689	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:xiangshan:nemu:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-20 20:16

Updated : 2026-06-17 10:29

NVD link : CVE-2026-29649

Mitre link : CVE-2026-29649

CVE.ORG link : CVE-2026-29649

JSON object : View

Products Affected

xiangshan

nemu

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-29649", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29649", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T13:47:02.557376Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-04-20T20:16:48.410", "references": [{"url": "https://docs.riscv.org/reference/isa/priv/hypervisor.html", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://docs.riscv.org/reference/isa/priv/machine.html", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/OpenXiangShan/NEMU/issues/681", "tags": ["Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/OpenXiangShan/NEMU/pull/689", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1)."}], "lastModified": "2026-06-17T10:29:51.177", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xiangshan:nemu:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFAE3DA2-A447-41AA-A36B-16D9329AA1FA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}