CVE-2026-67846: BOOM Privilege Escalation Vulnerability

CVE-2026-67846 Overview

CVE-2026-67846 affects the Berkeley Out-of-Order Machine (BOOM), an open-source RISC-V processor design. The vulnerability resides in the v3 and v4 Non-Blocking Data Translation Lookaside Buffer (NBDTLB) implementations at commit 5223e44cfeb26f41380057a2eb4d651197475f69. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site. This flaw introduces an incorrect privilege assignment condition in the memory translation path, which can influence how supervisor-mode accesses to user pages are evaluated by the hardware.

Critical Impact
The NBDTLB permission logic can grant supervisor-mode access to user pages when address translation is disabled, undermining the isolation guarantees of the RISC-V privileged architecture.

Affected Products

RISC-V BOOM core, v3 NBDTLB implementation
RISC-V BOOM core, v4 NBDTLB implementation
BOOM source tree at commit 5223e44cfeb26f41380057a2eb4d651197475f69

Discovery Timeline

2026-08-18 - CVE-2026-67846 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-67846

Vulnerability Analysis

The RISC-V privileged specification allows supervisor software to access user pages only when mstatus.SUM is set and address translation is active. Activation is governed by satp.MODE. When translation is disabled (satp.MODE = Bare), the SUM bit has no defined effect on memory protection. In the BOOM NBDTLB implementations for v3 and v4, the raw mstatus.SUM value is consumed by read and write permission logic without a co-located check that satp.MODE selects a paged translation mode. The permission calculation therefore treats SUM as authoritative even in states where it should not influence access decisions.

Root Cause

The root cause is a missing local validity gate. The permission signal is derived directly from mstatus.SUM at the use site, rather than from a composed signal that requires both SUM and a valid, translating satp.MODE. This is an [CWE-266] incorrect privilege assignment defect in speculative, non-blocking translation logic, compounded by BOOM's out-of-order execution semantics that can propagate mistranslated permissions through in-flight loads and stores.

Attack Vector

Exploitation requires local code execution on a BOOM-based system. An attacker running supervisor-mode code, or code able to influence mstatus and satp state transitions, can construct execution windows where the NBDTLB evaluates SUM without a corresponding paged translation mode. The resulting permission decision can allow accesses that the architectural specification would otherwise deny, breaking the boundary between supervisor and user memory regions.

text

// Patch excerpt from src/main/scala/v3/exu/execution-units/rocc.scala
   io.core.rocc.mem.perf.storeBufferEmptyAfterLoad := false.B
   io.core.rocc.mem.perf.storeBufferEmptyAfterStore := false.B
   io.core.rocc.mem.clock_enabled := false.B
+  io.core.rocc.mem.store_pending := false.B
 
   // RoCC execute queue. Wait for PNR, holds operands and inst bits
   val rxq_val       = Reg(Vec(numRxqEntries, Bool()))

Source: RISC-V BOOM commit 5223e44

Detection Methods for CVE-2026-67846

Indicators of Compromise

Supervisor-mode loads or stores succeeding against user-mode virtual addresses while satp.MODE = Bare.
Anomalous kernel memory accesses that bypass expected user-page protection checks.
Presence of the vulnerable BOOM commit 5223e44cfeb26f41380057a2eb4d651197475f69 in synthesized hardware bitstreams or simulation builds.

Detection Strategies

Audit the BOOM source tree for the affected NBDTLB v3 and v4 modules and confirm the local satp.MODE validity gate is present at every use of mstatus.SUM.
Run RISC-V architectural test suites that exercise supervisor accesses to user pages under Bare, Sv39, Sv48, and Sv57 translation modes.
Use formal verification or targeted RTL simulation to prove that permission signals require both mstatus.SUM and a translating satp.MODE.

Monitoring Recommendations

Instrument simulation runs and FPGA prototypes to log page-permission decisions, correlating them against mstatus and satp register state.
Track downstream BOOM forks and derived cores for backports of the fix on the RISC-V BOOM repository.
Review the published proof-of-concept for CVE-2026-67846 to derive regression tests for internal verification pipelines.

How to Mitigate CVE-2026-67846

Immediate Actions Required

Inventory all internal projects, tapeouts, and FPGA images that incorporate BOOM v3 or v4 NBDTLB code from commit 5223e44cfeb26f41380057a2eb4d651197475f69 or earlier.
Freeze downstream integration of the affected NBDTLB modules until a validated fix is applied.
Notify hardware and firmware teams consuming BOOM IP so kernel and hypervisor developers can plan compensating checks.

Patch Information

Apply the upstream fix from the RISC-V BOOM commit log that composes mstatus.SUM with an explicit local satp.MODE validity check at the NBDTLB use site. Rebuild any FPGA images, simulation binaries, or synthesized ASIC deliverables that depend on the corrected RTL, and rerun the full architectural regression suite before promoting builds.

Workarounds

Restrict deployment of vulnerable BOOM builds to isolated research or simulation environments that do not run untrusted supervisor or user workloads.
In supervising software, avoid execution paths that hold mstatus.SUM asserted while satp.MODE = Bare, reducing the exploitable window until the RTL fix is applied.
Disable NBDTLB features or fall back to a blocking DTLB configuration in downstream forks where feasible.

bash

# Verify whether a local BOOM checkout contains the vulnerable commit
cd riscv-boom
git log --oneline | grep 5223e44cfeb26f41380057a2eb4d651197475f69

# Inspect the NBDTLB modules for the missing satp.MODE gate
grep -R "mstatus.sum" src/main/scala/v3/lsu/ src/main/scala/v4/lsu/