CVE-2026-29648 - Vulnerability Analysis

Overview

OpenXiangShan NEMU contains a broken access control caused by improper clearing of mstateen0.ENVCFG when Smstateen is enabled, letting less-privileged code read or write henvcfg and senvcfg CSRs without exception, exploit requires Smstateen enabled.

Severity & Score

Impact

Less-privileged code can bypass isolation controls to read or write sensitive CSRs, risking privilege escalation or security boundary bypass.

Mitigation

Update to the latest version with proper mstateen0.ENVCFG handling.

References

• https://github.com/OpenXiangShan/XiangShan/pull/3978
• https://docs.riscv.org/reference/isa/priv/smstateen.html
• https://github.com/OpenXiangShan/NEMU/issues/690

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner