Vulnerability Description
In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://docs.riscv.org/reference/isa/priv/smstateen.html
- https://github.com/OpenXiangShan/NEMU/issues/690
- https://github.com/OpenXiangShan/XiangShan/pull/3978
- https://github.com/OpenXiangShan/NEMU/issues/690
FAQ
What is CVE-2026-29648?
CVE-2026-29648 is a vulnerability with a CVSS score of 8.8 (HIGH). In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs wi...
How severe is CVE-2026-29648?
CVE-2026-29648 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29648?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.