The vulnerability CVE-2026-29648 affects OpenXiangShan NEMU when Smstateen is enabled. The issue arises because clearing the mstateen0.ENVCFG bit does not correctly enforce access restrictions on the henvcfg and senvcfg CSRs. Consequently, less-privileged code can access these CSRs without the expected exceptions, undermining the intended isolation mechanisms that rely on state-enable controls. This can lead to unauthorized read/write operations on critical configuration registers in virtualized or multi-privilege environments, potentially compromising system security. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been documented.

The vulnerability allows less-privileged code to bypass intended isolation controls by reading or writing sensitive CSRs (henvcfg and senvcfg) without triggering exceptions. This can compromise confidentiality, integrity, and availability in virtualized or multi-privilege environments relying on these state-enable based isolation mechanisms. The high CVSS score (8.8) reflects the critical nature of this impact. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor vendor communications for updates. No specific mitigation or workaround is provided in the available information.