CVE-2026-29646

Published: Apr 20, 2026Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial of service or privilege-boundary violation in environments relying on NEMU for correct interrupt virtualization.

Related CWEs

Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

References (7)

https://docs.riscv.org/reference/isa/priv/hypervisor.html

Source: cve@mitre.org

https://docs.riscv.org/reference/isa/priv/machine.html

Source: cve@mitre.org

https://docs.riscv.org/reference/isa/priv/supervisor.html

Source: cve@mitre.org

https://docs.riscv.org/reference/isa/unpriv/zicsr.html

Source: cve@mitre.org

https://github.com/OpenXiangShan/NEMU/issues/951

Source: cve@mitre.org

https://github.com/OpenXiangShan/NEMU/pull/938

Source: cve@mitre.org

https://github.com/OpenXiangShan/NEMU/pull/938/commits/55295c46580456d8d5a9d5736e1fda924b8825ab

Source: cve@mitre.org

Timeline

No history available yet.