CVE-2026-71694 RISC-V BOOM Processor Improper Access Control via MRET/MPRV State

Vulnerability Overview CVE ID: CVE-2026-71694 Vulnerability Type: Improper Access Control (CWE: CWE-284) Attack Vector: Local Security Impact: Incorrect privilege state restoration after MRET Incorrect interpretation of memory access permissions Retention of the privileged state MPRV/MPP Potential privilege escalation under affected execution conditions Affected Products: Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark, distributed as part of ProcessorFuzz. Affected Versions: ProcessorFuzz public commit: Affected Components: Logic related to CSR trap-return state restoration, including: MRET handling logic update logic privileged state restoration state restoration logic Load/store privilege interpretation after trap return Attack Conditions: Exploitation requires executing the privileged trap return path. A local attacker, test program, OS component, firmware component, hypervisor component, or other privileged execution path capable of influencing the machine-mode CSR state can establish the following conditions: 1. is set to 1; 2. specifies a privilege level below machine mode; 3. is executed to return from M-mode to S-mode or U-mode; 4. The affected implementation retains after the privilege transition. Technical Description: modifies the effective privilege level for explicit load and store operations. When machine-mode software uses , the effective privilege for memory accesses can be determined based on the privilege level stored in . When returns execution to a privilege level below machine mode, the architectural privilege restoration process should clear the state. In the affected BOOM/BoomTile RTL benchmark, reproducible evidence indicates that is executed after returning from M-mode, while remains set. Specification Requirements: The RISC-V Privileged Architecture defines trap return behavior for privilege state restoration. For the relevant transitions, when the restored privilege level is below machine mode, the state must not remain active as a machine-mode privilege control state. The behavior demonstrated in the provided evidence violates the expected privilege state restoration behavior. Reproducible Evidence: This repository contains public evidence supporting the reproduction and analysis of the issue. The evidence package includes: Trigger input Complete Raw execution trace checker parser SHA-256 manifest ProcessorFuzz public baseline comparison Unified RTL diff Comparison of critical / / statements Verification Against Public Baseline: The affected public ProcessorFuzz baseline is . ProcessorFuzz commit: . The SHA-256 of the submitted evidence RTL is . The SHA-256 of the public ProcessorFuzz baseline RTL is . The submitted evidence RTL is compared against the public ProcessorFuzz BOOM baseline. The differences primarily relate to CSR trace logging and auxiliary observation signals used for logging. The relevant / / RTL statements were extracted separately from the evidence RTL and the public baseline. After removing line number differences, the comparison of the relevant statements showed no discrepancies, supporting the finding that observation instrumentation does not modify the relevant CSR/MRET privilege state restoration logic. Public Disclosure Date: July 11, 2026 References: ProcessorFuzz: https://github.com/uc-iscg/ProcessorFuzz Berkeley Out-of-Order Machine (BOOM): https://github.com/riscv-boom/riscv-boom RISC-V ISA Manual: https://github.com/riscv/riscv-isa-manual Public Vulnerability Announcement and Support Evidence: https://github.com/duan528/BOOM-MRET-MPRV-Vulnerability-Report Discoverer: Duan Xuemei Scope of Impact Affected Products: Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark, distributed as part of ProcessorFuzz. Affected Versions: ProcessorFuzz public commit: Affected Components: Logic related to CSR trap-return state restoration, including MRET handling logic, update logic, privileged state restoration, state restoration logic, and load/store privilege interpretation after trap return. Remediation Current Status: There are currently no known fixed versions. Recommended Actions: Users are advised to monitor subsequent updates and promptly apply official security patches as they are released. Additionally, reviewing and verifying the relevant code logic can help ensure the correctness of privilege state restoration, thereby reducing potential security risks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-71694 RISC-V BOOM Processor Improper Access Control via MRET/MPRV State

More from this source