OpenXiangShan NEMU CVE-2026-29648

Smstateen extension must be explicitly enabled in the OpenXiangShan NEMU configuration - this is a non-default RISC-V architectural extension for state-enable control. Attacker requires authenticated code execution within the NEMU emulation environment at supervisor or lower privilege level (PR:L confirmed by CVSS). Exploitation specifically occurs when higher-privilege software has cleared the mstateen0.ENVCFG bit with the intent to restrict access to henvcfg and senvcfg CSRs. Primary risk scenarios are RISC-V hypervisor development environments, trusted execution research platforms, or multi-privilege software validation frameworks where the victim system intentionally uses Smstateen for privilege isolation. Exploitation is LIMITED by the specialized deployment context: NEMU is a research/development tool rather than production software, significantly reducing exposed attack surface compared to network-facing services despite the AV:N CVSS rating.

Real-world risk is MODERATE with caveats. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability with network attack vector (AV:N), but this appears inconsistent with the technical context. The description and references indicate this is a processor emulator vulnerability affecting RISC-V architectural simulation, not a network service. Attack vector should likely be LOCAL (AV:L) since exploitation requires executing code within the NEMU emulation environment with at least low-privilege access (PR:L confirmed). EPSS 0.02% suggests security researchers assess minimal real-world exploitation likelihood, consistent with the specialized nature of processor emulators used primarily in research and development rather than production deployments. No CISA KEV listing indicates no confirmed active exploitation. GitHub issue #690 and pull request #3978 suggest proof-of-concept code exists and a fix has been developed. Primary risk applies to organizations using NEMU for trusted execution environment (TEE) research, hypervisor development, or security-sensitive RISC-V software validation where privilege boundary violations could compromise test isolation or leak sensitive architectural state. Production impact is LIMITED unless NEMU is deployed in shared research infrastructure. CVSS-EPSS divergence suggests high theoretical severity but low practical exploitability in typical deployment scenarios.

An attacker with authenticated access to a system running OpenXiangShan NEMU executes malicious code within a guest operating system or lower-privilege supervisor mode. The attacker's code directly accesses henvcfg or senvcfg CSRs after the hypervisor or higher-privilege software has cleared mstateen0.ENVCFG to restrict access. Instead of triggering an illegal instruction exception, the access succeeds, allowing the attacker to modify memory management settings, interrupt routing, or other critical hypervisor state. This enables privilege escalation to hypervisor level or breaks isolation between virtual machines in a nested virtualization scenario. Proof-of-concept code is available via GitHub issue #690.