CVE-2026-29644 Details

A vulnerability in the XiangShan open-source RISC-V processor has been identified, specifically in the distributed Control and Status Register (CSR) write-enable path. The issue arises from improper gating, which allows illegal CSR write attempts to modify the state of custom Physical Memory Attribute (PMA) CSRs. According to the RISC-V privileged specification, such illegal accesses should trigger an exception. However, in the affected XiangShan versions, these illegal writes can propagate to the replicated PMA configuration state. This vulnerability can be exploited by local attackers with code execution capabilities on the core, potentially leading to unauthorized changes in memory attribute enforcement. The impact could include privilege escalation, information disclosure, or denial-of-service, depending on how PMA manages platform security and isolation.

The vulnerability has been addressed in a recent commit, which corrects the CSR write-enable gating issue. Users should update to the latest version of XiangShan to apply this fix.