CVE-2026-71694: Berkeley BOOM Processor RCE Vulnerability

CVE-2026-71694 Overview

CVE-2026-71694 affects the Berkeley Out-of-Order Machine (BOOM), an open-source RISC-V processor design used in academic and industrial research. The issue exists in BoomTile RTL benchmark v1.2 at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619. The flaw resides in the Control and Status Register (CSR) trap-return state restoration logic, specifically in MRET handling and the mstatus.MPRV update path within the CSRFile logic. A remote attacker can leverage the incorrect state restoration to execute arbitrary code on affected cores.

Critical Impact
Improper CSR state restoration during machine-mode trap returns allows a remote attacker to execute arbitrary code on BOOM-based RISC-V cores.

Affected Products

Berkeley Out-of-Order Machine (BOOM) RISC-V core
BoomTile RTL benchmark v1.2 (commit 2d08d0d8b4563212175212f9db0e69f6e68c9619)
Benchmarks/Verilog/SmallBoomTile_v1.2_state.v from the ProcessorFuzz BOOM benchmark set

Discovery Timeline

2026-08-19 - CVE-2026-71694 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71694

Vulnerability Analysis

The RISC-V MRET instruction returns from a machine-mode trap by restoring privilege state from the mstatus CSR. During this sequence, the previous privilege bits (MPP), the interrupt-enable stack (MIE/MPIE), and the MPRV bit must be updated atomically and consistently. The BOOM CSRFile implementation in the affected benchmark does not restore this state correctly. This leaves the core in a privilege configuration that diverges from the RISC-V ISA specification. An attacker who triggers a controlled trap-return sequence can influence memory access privileges through a stale or inconsistent MPRV bit.

Root Cause

The defect is in the CSR trap-return state restoration logic inside the CSRFile module. MRET handling updates the mstatus.MPRV field along an incorrect path, producing a mismatch between the architecturally expected privilege state and the state the pipeline observes. Because MPRV governs whether loads and stores use the previous privilege level for address translation and permission checks, an incorrect update lets lower-privileged code influence memory operations that should execute under machine-mode constraints.

Attack Vector

A remote attacker capable of running or delivering code that executes on an affected core issues a crafted sequence of CSR writes and MRET instructions. The malformed state restoration allows the attacker to bypass privilege boundaries and gain arbitrary code execution. Detailed reproduction steps and RTL analysis are published in the BOOM MRET/MPRV Vulnerability Report and were surfaced through the ProcessorFuzz hardware fuzzing framework.

No verified exploit code is published. See the RISC-V ISA Manual for the specified MRET and mstatus.MPRV behavior and the RISC-V BOOM project for the current upstream implementation.

Detection Methods for CVE-2026-71694

Indicators of Compromise

Unexpected transitions of the mstatus.MPRV bit outside of legitimate MRET/MPRV-manipulating code sequences.
Memory accesses from machine-mode code that resolve using a lower privilege level's translation or permission set.
Divergence between simulated ISA-model state and RTL state during MRET execution when running the affected SmallBoomTile_v1.2_state.v benchmark.

Detection Strategies

Run differential testing between a golden RISC-V ISA simulator (Spike, Sail) and the BOOM RTL, focusing on CSR state after every trap and MRET.
Use hardware fuzzing tools such as ProcessorFuzz to replay the published trigger sequences against local BOOM builds.
Add RTL assertions on CSRFile that enforce ISA-defined mstatus transitions during MRET.

Monitoring Recommendations

Track upstream commits to riscv-boom for fixes touching the CSRFile and trap-return paths.
Audit downstream SoCs and FPGA bitstreams built from affected BOOM revisions for redistribution of the vulnerable RTL.
Log privilege-mode transitions and mstatus writes in pre-silicon simulation regressions.

How to Mitigate CVE-2026-71694

Immediate Actions Required

Identify any tape-outs, FPGA deployments, or research builds derived from BoomTile v1.2 at commit 2d08d0d8b4563212175212f9db0e69f6e68c9619.
Halt production or externally exposed use of affected BOOM configurations until the CSR logic is corrected.
Rebase local BOOM forks onto an upstream revision that includes a corrected CSRFile trap-return implementation.

Patch Information

No vendor patch identifier is published in the NVD entry for CVE-2026-71694. Track fixes in the upstream RISC-V BOOM repository and align the CSRFileMRET and mstatus.MPRV update path with the behavior defined in the RISC-V ISA Manual.

Workarounds

Restrict execution of untrusted code on affected BOOM cores, particularly workloads that issue CSR writes and MRET instructions.
Disable or constrain use of the mstatus.MPRV feature in supervisor and machine-mode software where feasible.
Add RTL assertions or a wrapper around CSRFile that forces ISA-conformant mstatus updates during trap-return, pending an upstream fix.

bash

# Verify the BOOM commit in use against the affected revision
git -C riscv-boom rev-parse HEAD
# Compare against the vulnerable commit
# 2d08d0d8b4563212175212f9db0e69f6e68c9619