MIT CSAIL: Interrupt Injection Bypasses Spectre v2 on Intel and…

MIT CSAIL researchers demonstrated that an unprivileged Linux program can inject precisely timed hardware interrupts to bypass Spectre v2 mitigations. On AMD Zen 2 running Linux 6.14 with all defenses active, the technique leaked kernel memory at 5.47 bytes/second with 91.97% accuracy. Disclosed on February 5, 2026, the issue still lacks a public CVE, kernel commit, or vendor advisory as of August 6, leaving administrators unable to verify protection status.

MIT CSAIL researchers Daniël Trujillo and Mengjia Yan presented a technique dubbed INTERRUPT INJECTION at Black Hat USA 2026 that bypasses Spectre v2 mitigations on Intel and AMD processors. The demonstration, conducted on AMD Zen 2 with Linux 6.14 and all defenses enabled, leaked kernel memory at 5.47 bytes/second with 91.97% accuracy. The disclosure dates to February 5, 2026, yet as of August 6 no public CVE, kernel commit, or official vendor bulletin exists to let administrators verify their protection status.

Key Takeaways

On AMD Zen 2, an unprivileged Linux program read /etc/shadow in 5 of 10 attempts by exploiting a 2-instruction window between branch predictor sanitization and use
The technique injects hardware interrupts with nanosecond precision to land in that temporal gap, then re-poisons the predictor via Inception (CVE-2023-20569)
Intel paid a discretionary bug bounty but does not consider mitigation necessary; AMD promised a kernel patch without releasing verifiable documentation
The researchers formalized a new attack class called TONTOU (Time-of-Neutralization to Time-of-Use), applicable to any non-atomic hardware neutralization

How the Race in the Branch Predictor Works

Spectre v2 mitigations — eIBRS on Intel, saferet on AMD — sanitize the branch predictor before the kernel uses predictions derived from less-privileged code. This sanitization is not atomic: a window exists between the moment the defense executes and the moment the kernel actually reads the predictor.

Trujillo and Yan demonstrated that a hardware interrupt can be timed to land precisely in that window. On AMD Zen 2 the gap measures 6 bytes, or 2 instructions. The OS allows user-space programs to schedule interrupts with nanosecond granularity, making the attack feasible without special privileges.

Once inside the window, the interrupt handler becomes a training gadget. The researchers used Inception (CVE-2023-20569), a vulnerability rated 4.7 MEDIUM by the NVD, to fill the Return Stack Buffer with attacker-controlled targets. The effect is re-poisoning the predictor after the mitigation has already declared the environment safe.

The success rate for landing in the window varies: 5% to 12% generally, dropping to roughly 2% when registers are under attacker control. These seemingly low absolute values suffice for systematic leakage thanks to the attack’s repeatability.

The Demo Numbers and the Vendor Divide

Measured misprediction rates show a heterogeneous distribution across architectures. On AMD Zen 2 the misprediction success rate is 0.75%. On Intel Arrow Lake it falls to 0.22%, on Cascade Lake Refresh to 0.037%. AMD Zen 4 showed no mispredictions in the researchers’ test.

"An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run"

Despite these numbers, vendor responses diverge sharply. According to the researchers’ paper, Intel "does not consider mitigation to be required," justifying the stance by stating exploitability "depends on many factors." The company nevertheless awarded a discretionary bug bounty bonus. Intel guidance INTEL-SA-00598, updated May 2025, does not mention interrupts.

AMD told the researchers a kernel patch is planned. MIT CSAIL states the patch has been submitted, but The Hacker News found no commit in the Linux kernel repository, no CVE, and no AMD security bulletin documenting it at time of publication.

Why the Lack of Public Trace Is a Security Problem

The situation creates a non-trivial risk-management gap. Administrators of multi-tenant systems and cloud environments who have enabled Spectre v2 mitigations over the years — eIBRS, saferet, retpoline where applicable — have no tools to verify whether their protections are effective against INTERRUPT INJECTION. No advisory lists patched kernel versions, no CVE enables tracking in vulnerability management tools, and no Intel communication formally acknowledges the attack class.

The gap between MIT’s claim ("patch submitted") and the absence of public evidence is the editorial crux: hardware security demands verifiable transparency, not unilateral trust. If an administrator cannot confirm they are protected, they cannot document risk posture for audits or their tenants.

The brief does not specify corrective measures operators can adopt independently. The source documents no temporary countermeasures, workarounds, or configurations that reduce attack surface pending official release.

TONTOU: An Attack Class Beyond Spectre

The researchers named TONTOU (Time-of-Neutralization to Time-of-Use) the general class of which INTERRUPT INJECTION is an instance. The principle applies to any hardware neutralization that is not atomically coincident with its protective effect: if a measurable temporal gap exists between sanitization and actual use, that gap is a vector.

The proposed fix advanced by the researchers calls for a second neutralization on interrupt exit — RSB stuffing before iret, or IBHF on newer Intel generations — but the brief reports no data on the performance cost of this double defense. The paper is slated for USENIX Security; until publication the artifact repository is unavailable.

The brief records no responses from ARM vendors, though the researchers mentioned contact. No infrastructural overlap emerges linking INTERRUPT INJECTION to prior variants such as GhostRace (CVE-2024-2193) or Native BHI (CVE-2024-2201): the specific mechanism — timed hardware interrupts — is distinct from training via eBPF or branch history injection.

Why It Matters

The source does not specify the full nature of exposed data beyond the /etc/shadow demonstration. The dossier does not document whether other operating systems beyond Linux 6.14 are affected, nor does it provide a timeline for the artifact repository’s publication. No evidence of in-the-wild exploitation emerges.

The misalignment between Intel’s assessment (not required) and AMD’s (patch planned but unverifiable) creates confusion over protection priorities and perimeters. For researchers, TONTOU opens a field of inquiry into other hardware neutralizations that may present similar gaps. For operators, the immediate lesson is that an enabled mitigation is not automatically a working mitigation if no way exists to verify its status.

The source does not specify corrective measures, temporary countermeasures, or risk-reducing configurations. The brief documents no indicators of compromise associated with this technique.

Information is based on the cited advisory and current as of publication.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references