CVE-2026-29649 Details
Description
NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1).
A vulnerability exists in NEMU's RISC-V hypervisor handling of control and status registers (CSRs), specifically in the management of the `henvcfg` and `menvcfg` registers. The issue arises because certain fields in `henvcfg` are incorrectly linked to `menvcfg`, allowing unintended modifications of the hypervisor's environment configuration. This flaw can disrupt the proper enforcement of virtualization settings and may lead to unexpected traps or denial-of-service conditions when executing cache-block management instructions in virtualized environments.
Users can update to NEMU version v2025.12.r1, which includes a fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.riscv.org/reference/isa/priv/hypervisor.html | [email protected] | Product |
| https://docs.riscv.org/reference/isa/priv/machine.html | [email protected] | Product |
| https://github.com/OpenXiangShan/NEMU/issues/681 | [email protected] | Issue Tracking |
| https://github.com/OpenXiangShan/NEMU/pull/689 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| xiangshan nemu | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | New CVE Received | [email protected] |