TONTOU Attack: How MIT CSAIL Researchers Bypassed Spectre v2 Defenses on AMD and Intel CPUs

TONTOU invalidates that assumption. On AMD's Safe RET, the vulnerable window is just two instructions wide . An unprivileged attacker can inject a precisely-timed hardware interrupt (called INTERRUPT INJECTION) that lands in that gap, re-poisoning the branch predictor after the defense has already run but before the kernel consumes the predictor state . This re-enables speculative execution side-channel leakage despite all intended protections being in place.

The attack requires only the ability to run unprivileged user-space code on the target machine. No elevated privileges are needed .

Demonstrated Impact: Leaking Linux Password Hashes

The researchers built a full end-to-end exploit and tested it across multiple processor generations:

• Tested processors: Intel Cascade Lake Refresh, Intel Arrow Lake, AMD Zen 2, and AMD Zen 4 .
• On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16GB RAM and default Spectre v2 protections, the attack leaked arbitrary kernel memory at 5.47 bytes per second .
• The leak achieved 91.97% accuracy on the extracted data .
• The researchers successfully located and extracted the contents of /etc/shadow (containing Linux password hashes) in five out of ten attempts, with each attempt taking approximately 18 minutes .

On Intel platforms, the researchers demonstrated partial bypass of eIBRS on Cascade Lake Refresh and Arrow Lake, though the attack surface differs from the AMD Safe RET case . The study did not confirm successful branch misdirection on AMD Zen 4 using the same method .

Industry Response and Patches

The disclosure and response timeline was swift:

• February 5, 2026: Researchers coordinated disclosure to AMD, Intel, and Arm .
• June 2, 2026: Linux kernel patches were committed, authored by AMD's Borislav Petkov, with the commit title "x86/bugs: Make Safe-RET robust against interrupt injection" .
• August 5, 2026: The patch was accepted into the mainline Linux kernel .
• August 6, 2026: AMD published security bulletin AMD-SB-7061 ("Safe RET Interrupt Vulnerability"), naming Zen 1 through Zen 4 processors as affected. AMD assessed the issue as tied to the Linux implementation of Safe RET for the Speculative Return Stack Overflow (SRSO) mitigation rather than the processor architecture alone .
• August 6, 2026: The patch shipped in Linux kernel versions 7.1.7, 6.18.43, 6.6.149, and 6.1.181, addressing CVE-2026-68480 .

Intel acknowledged the findings during the coordinated disclosure process and awarded a prize from its bug bounty program, but told researchers it would not develop additional mitigations, citing factors such as the availability of disclosure gadgets needed for real-world exploitation .

Implications for CPU Security

TONTOU represents a significant evolution in speculative execution attacks. Unlike earlier Spectre variants that targeted the core prediction mechanism itself, TONTOU attacks the mitigation — the very software and hardware defenses built to stop previous attacks. By identifying a race condition between neutralization and use, the researchers have opened a new class of vulnerability that will require fundamentally different defensive approaches.

The attack also demonstrates that CPU security cannot be solved by software patches alone. While the Linux kernel fix closes the specific interrupt injection window on AMD Zen processors, the underlying architectural assumption — that predictor sanitization and predictor usage can be treated as an atomic operation — has been proven false.