CVE-2026-29649

OVERVIEW CVE-2026-29649 is a critical implementation flaw in NEMU's RISC-V Hypervisor CSR (Control and Status Register) handling. The vulnerability exists in the masking and updating of henvcfg fields (specifically bits 7:4 related to cache-block instruction controls), which are incorrectly synchronized with menvcfg values. This design flaw allows machine-mode writes to menvcfg to implicitly and unintentionally modify the hypervisor's environment configuration, affecting virtualized systems running on NEMU-based hypervisors. SEVERITY The vulnerability carries a CVSS 3.1 score of 9.8 (CRITICAL) with a network-accessible attack vector, low complexity, and no privilege or user interaction required. An attacker can exploit this flaw to achieve high impact across confidentiality, integrity, and availability. The core risk involves incorrect enforcement of virtualization boundaries and configuration controls, which can result in unexpected exception traps or denial of service when cache-block management instructions are executed in virtualized contexts. The ability to modify security-relevant hypervisor configuration through a machine-mode write represents a significant control bypass. EXPLOITATION STATUS This vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The EPSS score of 0.00019 indicates this CVE ranks below the 51st percentile of vulnerabilities in terms of real-world exploitation likelihood. Community attention remains limited, consistent with the vulnerability's inactive status on industry hot lists. Organizations should treat this as a prospective threat requiring timely patching rather than an immediately imminent risk.