TONTOU Bypasses Spectre v2 Defenses, Reopening the Risk of Kernel Data Leakage

The technique exploits the gap between neutralization and reuse

Daniël Trujillo, a PhD student, and Mengjia Yan, an associate professor at MIT CSAIL, presented TONTOU on August 6, 2026, at Black Hat USA. Further details will be presented at USENIX Security 2026, scheduled for October 27–29.

TONTOU, short for Time-of-Neutralization to Time-of-Use, targets recent defenses against Spectre v2, also known as Branch Target Injection. These mitigations neutralize or isolate branch predictor state, but leave a time window before it is used again.

During this interval, an attacker can repopulate the microarchitectural state with manipulated information, effectively re-poisoning the branch predictor before the processor consults it.

Timed interrupts to control speculative predictions

The attack requires the adversary to execute arbitrary unprivileged code on the target Linux system. Direct access to arbitrary memory is not required.

The researchers used an Interrupt Injection technique: a user-space program schedules precisely timed interrupts while the kernel is running. The processor then switches to the interrupt handler, which becomes the point from which the attacker can influence the branch predictor.

The combination of hardware timers, frequent injections, and active and passive poisoning enables the attack to target every type of indirect branch. It can also manipulate the Return Stack Buffer (RSB), causing return addresses to be predicted incorrectly.

For this component, the researchers integrated Inception, a previously disclosed technique developed with contributions from Trujillo.

Results on AMD Zen 2

The main tests were conducted on an AMD Zen 2 processor running Linux 6.14.0-37-generic with 16 GB of RAM, after the latest Spectre v2 mitigations had been applied.

TONTOU successfully completed the neutralization, redirection, poisoning, and use phases against the compromised branch predictor. Arbitrary kernel memory extraction reached 5.47 bytes per second, with 91.97% accuracy.

The Linux /etc/shadow file, which contains password hashes, was located and extracted in 5 out of 10 tests. Each attempt took an average of 18 minutes.

The risk therefore involves the exposure of sensitive data stored in kernel memory. The attack is also possible on Intel processors, but requires additional software components and is more complex to implement.

What this means for Safe RET and eIBRS

TONTOU calls into question the effectiveness of defenses based solely on branch predictor neutralization. Clearing the state does not necessarily prevent a process from repopulating it during the subsequent window.

The technique particularly affects:

• AMD Safe RET;
• Intel eIBRS (enhanced Indirect Branch Restricted Speculation);
• AMD and Intel processors;
• Linux systems and the Linux kernel.

AMD published an advisory on August 6, 2026. According to the company’s assessment, the interrupt injection issue appears to be related to Linux’s implementation of the Safe RET mitigation, which was designed to counter potential information disclosure attacks.

No patches, definitive fixes, or effective workarounds have been announced yet. In the meantime, administrators should restrict the execution of untrusted code on Linux systems, update kernels and microcode or firmware, and verify the actual coverage of Spectre v2 mitigations, including Safe RET and eIBRS.