Skip to content
STIMSMITH

FENCE.I instruction

Concept

FENCE.I is discussed in the evidence as a RISC-V instruction whose incorrect handling can create processor-verification and security-relevant failures. TheHuzz reports a case where Ariane treated FENCE.I as an illegal instruction, diverging from Spike and producing a non-compliant RISC-V ISA behavior; a later ARCUS survey lists “Incorrect decoding of FENCE.I instruction” as a CVA6 vulnerability mapped to CWE-440 and evaluated by fuzzers including TheHuzz, HypFuzz, PSOFuzz, and MABFuzz.

First seen 5/26/2026
Last seen 8/27/2026
Evidence 6 chunks
Wiki v2

WIKI

Overview

FENCE.I is a RISC-V instruction discussed in the hardware-fuzzing evidence in the context of instruction-cache invalidation and instruction-stream behavior. In a TheHuzz-reported scenario, Spike identified the FENCE.I instruction and, when it did not recognize an extension, fell back to flushing the entire cache; by contrast, Ariane failed to recognize FENCE.I and marked it as an illegal instruction, which the paper describes as non-compliant with the RISC-V ISA.[C1]

Verification and security relevance

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

9 connections
RISC-V part of → 100% 2e
FENCE.I is a RISC-V instruction for cache coherency management.
RISC-V ISA part of → 93% 1e
fence.i is a RISC-V ISA instruction used to synchronise instruction and data streams.
TheHuzz ← evaluates 90% 1e
TheHuzz detects the incorrect decoding of FENCE.I instruction vulnerability in CVA6.
HyPFuzz ← evaluates 90% 1e
HypFuzz detects the incorrect decoding of FENCE.I instruction vulnerability in CVA6.
PSO-Fuzz ← evaluates 90% 1e
PSOFuzz detects the incorrect decoding of FENCE.I instruction vulnerability in CVA6.
MABFuzz ← evaluates 90% 1e
MABFuzz detects the incorrect decoding of FENCE.I instruction vulnerability in CVA6.
CVA6 part of → 85% 1e
The FENCE.I instruction vulnerability is a vulnerability found in CVA6.
STING ← evaluates 92% 1e
STING has exposed mishandling of the fence.i instruction in practice.
CWE mentions → 90% 1e
The FENCE.I instruction vulnerability is assigned CWE #440.

LINKED ENTITIES

6 links
TheHuzz EVALUATES Extracted graph relationship
HyPFuzz EVALUATES Extracted graph relationship
PSO-Fuzz EVALUATES Extracted graph relationship
MABFuzz EVALUATES Extracted graph relationship
CVA6 PART_OF Extracted graph relationship
CWE MENTIONS Extracted graph relationship

CITATIONS

3 sources
3 citations — click to collapse
[1] TheHuzz reports that Spike identified FENCE.I and flushed the cache when it did not recognize the extension, while Ariane failed to recognize FENCE.I and treated it as an illegal instruction, described as non-compliant with the RISC-V ISA. TheHuzz: Instruction Fuzzing of Processors Using Golden- ...
[2] TheHuzz describes the FENCE.I handling divergence as enabling old instructions to remain in Ariane, allowing replacement of bounds checks with effective no-ops, injection of a stack-overflow vulnerability, and arbitrary code execution. TheHuzz: Instruction Fuzzing of Processors Using Golden- ...
[3] ARCUS lists “Incorrect decoding of FENCE.I instruction” as vulnerability V1 in CVA6, maps it to CWE-440, and includes results for fuzzing techniques including TheHuzz, HypFuzz, PSOFuzz, and MABFuzz. SoK: ARCUS: On the Efficiency and Efficacy of Hardware Fuzzing