Researchers have discovered a sophisticated method to circumvent recent mitigations for **Spectre v2** speculative execution side-channel attacks, developing an exploit that can leak secrets from **Linux** machines. This new technique targets **Spectre v2** defenses on **AMD** and **Intel** processors that rely on sanitizing or isolating branch predictors, which the researchers generically refer to as neutralization-based mitigations. ### Understanding Spectre v2 and Branch Target Injection **Spectre v2**, also known as Branch Target Injection (BTI), is a variant of the broader **Spectre** class of vulnerabilities. It exploits a processor's indirect branch predictor, causing it to mispredict the target of an indirect branch. This misprediction leads to speculative execution along an attacker-influenced code path. Modern processors utilize branch prediction to anticipate the most likely execution path and employ speculative execution to run instructions along that predicted path before the branch outcome is definitively known. **Spectre v2** allows an attacker to manipulate the CPU's indirect branch predictor, compelling the processor to speculatively execute instructions at a location chosen by the attacker. This process can inadvertently expose sensitive data. ### The TONTOU Vulnerability: A Time-of-Neutralization to Time-of-Use Gap Current neutralization-based mitigations, such as **eIBRS** on **Intel** and **Safe RET** on **AMD**, operate under the assumption that an attacker cannot exploit the time window between the cleaning of the branch predictor state and its subsequent use by a victim branch. However, the researchers introduced a primitive that enables re-poisoning the CPU’s state *after* the cleaning but *before* it is used. This critical window is what **Daniël Trujillo**, a PhD student, and associate professor **Mengjia Yan** of the **MIT Computer Science and Artificial Intelligence Laboratory (CSAIL)** have termed the **Time-of-Neutralization to Time-of-Use (TONTOU)** window. “An attacker without any special access [can] read arbitrary memory from the system, including sensitive data such as hashed passwords,” Trujillo explained. ### Interrupt Injection: The Attack Vector The researchers developed an **Interrupt Injection** attack, where “unprivileged user programs can schedule timer interrupts to occur during kernel execution.” “Therefore, we can force the kernel to be redirected to the interrupt handler and use this handler to poison microarchitectural states within the post-neutralization window,” the [researchers explain](https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf). Interrupts occurring during this post-neutralization window can effectively poison the processor's indirect branch predictor, enabling attacks against all types of indirect branches. ### Successful Exploitation and Data Exfiltration **Mengjia** and **Trujillo** tested the attack, assuming an attacker could run arbitrary, unprivileged code on a **Linux** target machine to leak data from the kernel. On an **AMD Zen 2** host with the latest **Spectre v2** mitigations, the researchers successfully executed all stages of a **TONTOU** attack: neutralization, redirection, poisoning, and the use of the poisoned branch predictors.  Successfully exploiting this issue requires overcoming several obstacles, including redirecting kernel control flow, precisely aligning interrupts with the post-neutralization window, and using the interrupt handler to poison the branch predictor entry associated with the target indirect branch. These challenges were addressed through the installation of timers to trigger hardware interrupts, frequent injection of interrupts, and active and passive poisoning methods. ### Performance and Impact The attack was tested on both **Intel** and **AMD** processors. On an **AMD Zen 2** system running **Linux** version 6.14.0-37-generic with 16GB of RAM, the researchers demonstrated the ability to leak arbitrary kernel memory at a rate of 5.47 bytes/s with 91.97% accuracy. This included the contents of `/etc/shadow`, which stores password hashes. Across 10 test runs, the attack successfully located and extracted the file in five cases, with each attempt taking an average of 18 minutes. While the attack is also possible on **Intel** machines, the researchers noted that additional software requirements make the task more complex. ### Combining with Inception and AMD's Response The researchers also highlighted that interrupt injection enables attacker-controlled poisoning of the Return Stack Buffer (RSB), leading to speculative mispredictions of return targets. Given the unreliability of passive RSB pollution, they combined interrupt injection with **Inception**, a previously disclosed attack that **Daniël Trujillo** helped develop. **AMD** has since published an [advisory](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7061.html) noting that the interrupt injection issue “appears to be associated” with the **Linux** implementation of the **Safe RET** mitigation against potential information disclosure attacks. **Daniël Trujillo** and **Mengjia Yan** presented their findings today at the **Black Hat USA** security conference and will share further details at **USENIX Security 2026** between October 27 and 29.