CVE-2025-50897: riscv-boom SonicBOOM · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 26 Oct 2026, 13:47 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Given the nature of the vulnerability, mitigation should focus on the following practical steps: 1) Immediate assessment of all deployed systems using BOOMv1.2 processors to identify exposure. 2) Where possible, disable or avoid using SV39 virtual memory mode or store instructions that trigger the fault until a patch or microcode update is available. 3) Engage with processor vendors and open-source communities maintaining BOOM implementations to obtain patches or workarounds. 4) Implement enhanced monitoring for kernel panics and memory access faults to detect exploitation attempts or fault occurrences early. 5) For systems in development or testing, consider switching to alternative RISC-V cores or processor versions without this flaw. 6) Employ redundancy and failover mechanisms to mitigate potential denial of service impacts. 7) Review and harden kernel memory management configurations to minimize transitions that trigger the fault. 8) Maintain up-to-date backups and incident response plans tailored to handle unexpected system crashes. These steps go beyond generic advice by focusing on processor-specific configurations, vendor engagement, and operational continuity planning.
Description
A vulnerability exists in riscv-boom SonicBOOM 1.2 (BOOMv1.2) processor implementation, where valid virtual-to-physical address translations configured with write permissions (PTE_W) in SV39 mode may incorrectly trigger a Store/AMO access fault during store instructions (sd). This occurs despite the presence of proper page table entries and valid memory access modes. The fault is reproducible when transitioning into virtual memory and attempting store operations in mapped kernel memory, indicating a potential flaw in the MMU, PMP, or memory access enforcement logic. This may cause unexpected kernel panics or denial of service in systems using BOOMv1.2.