CVE-2026-29647

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

In OpenXiangShan NEMU, insufficient Smstateen permission enforcement allows lower-privileged code to access IMSIC state via stopei/vstopei CSRs even when mstateen0.IMSIC is cleared, potentially enabling cross-context information leakage or disruption of interrupt handling.

Published 2026-04-20. Last modified 2026-06-17.