An unprivileged Linux program can now time a hardware interrupt to land precisely in the gap between a processor sanitizing its branch predictor and the kernel using it. This allows for the re-poisoning of the predictor after the defense has already run. **Daniël Trujillo** and **Mengjia Yan**, researchers at **MIT CSAIL**, have dubbed this technique **INTERRUPT INJECTION**. Their exploit, demonstrated on an **AMD Zen 2** machine running **Linux 6.14** with all default **Spectre v2** mitigations enabled, successfully leaked arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97% accuracy. This was sufficient to locate and read `/etc/shadow`, which stores system password hashes, in five out of ten attempts. The attack requires no privileges beyond local code execution, posing a significant risk on shared systems utilizing affected processors. ### Disclosure and Vendor Response The researchers disclosed their findings to **AMD** and **Intel** on February 5. **AMD** indicated plans for a kernel patch, which has since shipped and is expected to arrive via normal operating system updates. The fix is integrated into the **Linux** kernel via commit `f5fdd6665ac4d8528ed1c9242cb1cf7a7f5bdb0e`, titled "x86/bugs: Make Safe-RET robust against interrupt injection." This commit, authored by **Borislav Petkov** and co-developed with **David Kaplan** (both **AMD** engineers), describes the attack in terms consistent with the researchers' findings: injecting interrupts during **Safe-RET** execution "can neutralize the safe return sequence, potentially leading to data leakage through speculative execution." **AMD** published bulletin **AMD-SB-7061**, "Safe RET Interrupt Vulnerability," on August 6, confirming that **Zen 1** through **Zen 4** processors are affected. The bulletin credits **Trujillo** and states that the behavior was demonstrated on **Zen 1** and **Zen 2**, with **Zen 3** and **Zen 4** suggested but not explicitly demonstrated. Interestingly, neither **AMD**'s bulletin nor **MIT**'s announcement points directly to the kernel commit, and no **CVE** has been assigned. Conversely, **Intel**, according to the researchers' paper, does not consider a mitigation necessary for its architectures. ### The TONTOU Vulnerability Class Existing defenses against speculative execution attacks, such as **Intel**'s **eIBRS** and branch history buffer clearing, or **AMD**'s **Safe-RET**, all operate on the assumption that no hostile code will execute in the critical window between branch predictor neutralization and its subsequent use. **Trujillo** and **Yan** categorize this vulnerability class as **TONTOU** (Time-of-Neutralization to Time-of-Use), drawing a parallel to the **TOCTOU** (Time-of-Check to Time-of-Use) races common in software. Interrupts fundamentally challenge this assumption. **Linux** allows users to schedule interrupts with nanosecond granularity, enabling them to fire almost anywhere. If interrupt handling can execute within this narrow window, the interrupt-return path becomes a critical part of the **Spectre v2** defense, even if the primary mitigation was designed around kernel entry or return. On **Zen 2**, this vulnerable window spans just two instructions, totaling six bytes. The researchers improved their odds by evicting these bytes from **L1** and **L2** cache using a sibling hyperthread, thereby slowing execution, and by selecting the `write` syscall, which granted them control over two registers. Interrupts successfully landed within this window 5% to 12% of the time, and around 2% when the attacker controlled specific registers. Once inside, the interrupt handler itself was leveraged as a training gadget, utilizing **Inception** (**CVE-2023-20569**) to fill the return stack buffer with an attacker-chosen target. **Inception** is an **AMD** flaw from 2023 that **Safe-RET** was designed to prevent. ### Cross-Architecture Impact Mispredictions were observed in kernel code on three of the four tested machines: 0.75% on **Zen 2**, 0.22% on **Intel Arrow Lake**, and 0.037% on **Cascade Lake Refresh**. **Zen 4** showed no mispredictions in this specific test, and an end-to-end leak was not demonstrated on **Intel** systems, which would also require a usable disclosure gadget already present in the kernel. However, the researchers do not view this as a significant barrier. They stated that mispredictions are "a necessary but not sufficient condition for a **Spectre** attack" and, given prior work demonstrating the existence of disclosure gadgets in kernels, "we believe an end-to-end attack is possible on **Intel** as well by combining our Interrupt Injection primitive with this work." **Intel** did award a discretionary bug bounty bonus but, according to the paper, "does not consider mitigation to be required." **Intel**'s stance is that exploitability "depends on many factors" and that the technique is covered by **existing guidance**. However, a review of **INTEL-SA-00598**, last updated in May 2025, revealed no mention of interrupts. The researchers presented their work at **Black Hat USA** today, and their paper is slated for presentation at **USENIX Security** in Baltimore next week.