Critical severity9.8NVD Advisory· Published Apr 20, 2026· Updated Apr 24, 2026
CVE-2026-29649
CVE-2026-29649
Description
NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:xiangshan:nemu:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:xiangshan:nemu:-:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
4- github.com/OpenXiangShan/NEMU/pull/689nvdIssue TrackingPatch
- docs.riscv.org/reference/isa/priv/hypervisor.htmlnvdProduct
- docs.riscv.org/reference/isa/priv/machine.htmlnvdProduct
- github.com/OpenXiangShan/NEMU/issues/681nvdIssue Tracking
News mentions
0No linked articles in our index yet.