What is the CVSS score of CVE-2026-29649?

CVE-2026-29649 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of NEMU are affected by CVE-2026-29649?

NEMU, the OpenXiangShan RISC-V full-system emulator, is vulnerable to denial-of-service attacks that can interrupt virtualized guest systems through improper handling of virtualization settings.

How to fix or mitigate CVE-2026-29649?

Within 24 hours, identify all systems running NEMU and determine if any are supporting guest code in virtualized mode (V=1) connected to production workloads. Within 7 days, request a risk assessment from your infrastructure or RISC-V architecture team regarding cache-block operations and contact OpenXiangShan maintainers for any available workarounds or mitigations specific to CVE-2026-29649. Within 30 days, implement compensating controls such as restricting cache-block instruction execution in guest contexts, isolate affected virtual machines from critical workloads, and establish monitoring to detect DoS events indicative of exploitation attempts.

NEMU CVE-2026-29649

EUVD-2026-23944 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-04-20 mitre

Denial Of Service N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.1 MEDIUM

Requires M-mode (highest-privilege) code execution inside the emulator so AV:L/PR:H; primary impact is DoS (A:H) with minor config-enforcement integrity (I:L) and no confidentiality loss.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:13 vuln.today

Analysis Generated

Jul 24, 2026 - 07:13 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

9.8 (CRITICAL)

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23944

CVE Published

Apr 20, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's environment configuration. This can lead to incorrect enforcement of virtualization configuration and may cause unexpected traps or denial of service when executing cache-block management instructions in virtualized contexts (V=1).

AnalysisAI

Denial of service and incorrect virtualization-configuration enforcement affect NEMU, the OpenXiangShan RISC-V full-system emulator, because its Hypervisor CSR logic derives henvcfg[7:4] (the CBIE/CBCFE/CBZE cache-block-management fields) from menvcfg[7:4] via an erroneous mask on read. As a result, machine-mode code that writes menvcfg implicitly mutates the hypervisor environment configuration, so guest code running virtualized (V=1) can hit unexpected traps or a denial-of-service when executing cache-block-operation (cbo.*) instructions. No public exploit is identified at time of analysis; EPSS is 0.01% and CISA SSVC lists exploitation as 'none', which conflicts sharply with the 9.8 NVD base score.

Technical ContextAI

NEMU emulates the RISC-V privileged architecture, including the M-mode CSR menvcfg and the hypervisor-extension CSR henvcfg. Per the RISC-V privileged and hypervisor specs (referenced in the advisory), menvcfg controls the environment configuration seen at lower privilege, while henvcfg independently controls the environment configuration for a virtualized guest (V=1); the low nibble [7:4] governs cache-block instruction behavior (Zicbom/Zicboz - CBIE, CBCFE, CBZE). The emulator bug is a protection-mechanism failure (CWE-693): in csr_read the henvcfg value was being AND-masked with menvcfg->val & MENVCFG_WMASK, so henvcfg's cache-block fields were tied to menvcfg instead of being maintained separately. The PR #689 fix removes the line 'henvcfg_out &= menvcfg->val & MENVCFG_WMASK;', restoring independent hypervisor configuration semantics. This is a functional-correctness flaw in an emulator's modeling of RISC-V CSRs, not a memory-safety defect in a network service.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in pull request https://github.com/OpenXiangShan/NEMU/pull/689, which removes the erroneous masking of henvcfg by menvcfg in src/isa/riscv64/system/priv.c (see issue https://github.com/OpenXiangShan/NEMU/issues/681). No tagged release version is provided in the input, so rebuild NEMU from a source tree that includes that commit rather than relying on a specific version tag. As NEMU is a development/verification tool, the practical compensating control until you rebuild is to avoid relying on NEMU's henvcfg cache-block (Zicbom/Zicboz) behavior for hypervisor-configuration correctness in test harnesses, and to treat any DoS/unexpected-trap results from virtualized (V=1) cbo.* instruction tests as suspect; there is no production service to firewall or feature-disable here, so no networking or access-control mitigation is applicable.