NEMU’s RISC‑V hypervisor contains an implementation flaw where the hypervisor configuration CSR fields henvcfg[7:4] are inappropriately masked and updated based on the machine‑mode configuration CSR menvcfg[7:4]. A write to menvcfg from machine mode implicitly changes the hypervisor’s environment configuration. This misconfiguration can cause the hypervisor to enforce incorrect virtualization settings, potentially triggering unexpected traps or resulting in a denial of service when executing cache‑block management instructions in a virtualised context (V=1). The vulnerability allows a privileged attacker to influence hypervisor behaviour without direct hypervisor accesses, compromising availability.

The flaw exists in the NEMU RISC‑V emulator. No specific version list is provided, so all instances of NEMU that employ the hypervisor CSR handling described are potentially affected. Because the vulnerability originates from the emulator’s core implementation, any build or fork that has not incorporated the recent fix is at risk.

The EPSS score is <1%, the CVSS score is 9.8, and the vulnerability is not listed in the CISA KEV catalog, indicating a high severity with low probability of exploitation. Based on the description, the likely attack vector involves a machine‑mode write operation that inadvertently alters hypervisor settings; such an attack would require access to a process with machine‑mode privileges or the ability to run arbitrary code within the emulator. The vulnerability could be exploited to cause denial of service or misconfigure virtual machines, impacting integrity of the hypervisor environment.