PT-2026-33980 · Xiangshan · Xiangshan

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-29644

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions XiangShan versions prior to commit edb1dfaf7d290ae99724594507dc46c2c2125384

Description Improper gating of the distributed CSR write-enable path allows illegal CSR write attempts to alter custom PMA (Physical Memory Attribute) CSR state. While the RISC-V privileged specification requires an illegal-instruction exception for non-existent or illegal CSR accesses, affected versions may propagate these writes to replicated PMA configuration state. Local attackers with code execution capabilities on the core can tamper with memory-attribute enforcement, which may lead to privilege escalation, information disclosure, or denial of service, depending on how the PMA enforces platform security and isolation boundaries.

Recommendations Update to commit edb1dfaf7d290ae99724594507dc46c2c2125384 or a newer version.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-29644

Affected Products

Xiangshan

References · 7

• 🔥 https://github.com/OpenXiangShan/XiangShan/issues/3959 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29644 · Security Note
• https://github.com/OpenXiangShan/XiangShan/commit/edb1dfaf7d290ae99724594507dc46c2c2125384 · Note
• https://github.com/OpenXiangShan/XiangShan/commit/2b1f9796aa98597e5eeac32e5bb1418496987ca4 · Note
• https://xiangshan-doc-test.readthedocs.io/next/memory/mmu/pmp_pma · Note
• https://docs.riscv.org/reference/isa/priv/priv-csrs.html · Note
• https://twitter.com/CVEnew/status/2046601500537864657 · Twitter Post