by Kastro
Paper/Archive/CVE-2026-29646

CVE-2026-29646

mitre — In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor int…

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
36
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 30.4.304 × 206.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial of service or privilege-boundary violation in environments relying on NEMU for correct interrupt virtualization.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdocs.riscv.org/reference/isa/priv/machine.htmlrefgithub.com/OpenXiangShan/NEMU/issues/951refgithub.com/OpenXiangShan/NEMU/pull/938refgithub.com/OpenXiangShan/NEMU/pull/938/commits/55295c46580456d8d5a9d5736e1fda924b8825abrefdocs.riscv.org/reference/isa/unpriv/zicsr.htmlrefdocs.riscv.org/reference/isa/priv/supervisor.htmlrefdocs.riscv.org/reference/isa/priv/hypervisor.html