CVE-2026-29646 describes a vulnerability in OpenXiangShan NEMU versions before commit 55295c4. When the RVH hypervisor extension is enabled, a VS-mode guest's write operation to the supervisor interrupt-enable CSR (sie) may incorrectly influence the machine-level interrupt enable state (mie). This improper handling compromises the isolation between privilege levels and virtualization boundaries, which can lead to denial of service or privilege escalation issues in systems depending on NEMU for interrupt virtualization correctness. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

The vulnerability allows a guest running in VS-mode to affect the machine-level interrupt enable state improperly, breaking the expected privilege and virtualization isolation. This can result in denial of service or violations of privilege boundaries, undermining the security guarantees of systems using NEMU with RVH for interrupt virtualization. No known exploits in the wild have been reported as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary workaround indicated in the available data. Users of OpenXiangShan NEMU should monitor vendor communications for updates and apply patches once available. Until then, consider limiting exposure of vulnerable NEMU instances or disabling RVH if feasible.