CVE-2026-29649: Nemu Henvcfg Overbroad Menvcfg Wmask
The read value of CSR henvcfg is masked with the full MENVCFG_WMASK against menvcfg (e.g. `henvcfg_out &= menvcfg->val & MENVCFG_WMASK;`). Because MENVCFG_WMASK covers bits [7:4] (CBIE/CBCFE/CBZE) in addition to STCE/DTE/PBMTE, this overbroad mask incorrectly subordinates henvcfg's cache-block-management fields to menvcfg. Per the RISC-V H-extension specific
Cgreprules fetch cve-2026-29649-nemu-henvcfg-overbroad-menvcfg-wmask --engine opengrepDescription
The read value of CSR henvcfg is masked with the full MENVCFG_WMASK against menvcfg (e.g. `henvcfg_out &= menvcfg->val & MENVCFG_WMASK;`). Because MENVCFG_WMASK covers bits [7:4] (CBIE/CBCFE/CBZE) in addition to STCE/DTE/PBMTE, this overbroad mask incorrectly subordinates henvcfg's cache-block-management fields to menvcfg. Per the RISC-V H-extension specific
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.