CVE-2026-29648

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.

Published 2026-04-20. Last modified 2026-06-17.