Researchers say a new CPU attack can get around recent Spectre v2 protections on Intel and AMD systems and steal sensitive data from Linux machines, including password hashes. The technique, called TONTOU for Time-of-Neutralization to Time-of-Use, abuses a gap after branch-predictor cleanup by injecting timer interrupts during kernel execution. On AMD Zen 2 and Intel systems with eIBRS or Safe RET mitigations, the researchers demonstrated leakage of arbitrary kernel memory, including /etc/shadow contents, from unprivileged code on Linux 6.14.0-37-generic.
Why it matters: This shows that systems believed protected against Spectre v2 may still leak highly sensitive data if an attacker can run code locally. Linux and hardware defenders should track vendor guidance, review mitigation updates, and treat untrusted code execution on shared systems as especially risky.
2026.08.07
98% relevant
This article is a direct report on the same TONTOU attack, adding specifics about how timed interrupts reopen the post-neutralization window, the tested Intel and AMD processor families, and that the researchers built a working end-to-end exploit on AMD Zen 2 using a stock Linux kernel with default mitigations.
Ionut Ilascu
2026.08.06
100% relevant
This article establishes a new story by introducing a newly disclosed speculative-execution attack technique, TONTOU, with concrete testing details and impact on current Spectre v2 mitigations.
← Back to all stories