Vulnerability Description
In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial of service or privilege-boundary violation in environments relying on NEMU for correct interrupt virtualization.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://docs.riscv.org/reference/isa/priv/hypervisor.html
- https://docs.riscv.org/reference/isa/priv/machine.html
- https://docs.riscv.org/reference/isa/priv/supervisor.html
- https://docs.riscv.org/reference/isa/unpriv/zicsr.html
- https://github.com/OpenXiangShan/NEMU/issues/951
- https://github.com/OpenXiangShan/NEMU/pull/938
- https://github.com/OpenXiangShan/NEMU/pull/938/commits/55295c46580456d8d5a9d5736
FAQ
What is CVE-2026-29646?
CVE-2026-29646 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can infl...
How severe is CVE-2026-29646?
CVE-2026-29646 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-29646?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.