Incorrect CSR dependency between henvcfg and menvcfg in NEMU (CVE-2026-29649)

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where the CBIE, CBCFE, and CBZE fields of henvcfg (bits 7:4) are incorrectly made dependent on the corresponding fields of menvcfg. A machine-mode write to menvcfg can implicitly and incorrectly modify the hypervisor environment configuration register henvcfg, leading to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts. Affected versions: - NEMU commit 3575e65 (Date: Fri Nov 22 17:06:53 2024 +0800) We recommend updating to: Release v2025.12.r1. CVSS 9.8 · our assessment: act_now Reference: https://github.com/OpenXiangShan/NEMU/issues/681 Details: https://vuln.today/cve/CVE-2026-29649