TONTOU: The AMD Attack Exposing the Gap Between Linux Patches and Vendor Disclosure

On August 6, 2026, AMD published advisory AMD-SB-7061 detailing the TONTOU (Time-of-Neutralization to Time-of-Use) method, developed by Daniël Trujillo and Mengjia Yan of MIT CSAIL. The Linux kernel already contained the fix as of June 2, but the source does not specify whether a CVE has been or will be assigned, nor does it indicate a kernel version containing the commit.

The Mechanism: A Nanosecond Race Against Safe RET

TONTOU exploits a timing condition in neutralization-based Spectre-v2 mitigations. AMD's Safe RET, analogous to Intel's eIBRS, clears branch predictor state before sensitive execution, assuming that state remains intact until use. The researchers prove it does not.

The concept is simple and the execution precise: an unprivileged program schedules timer interrupts during kernel execution. If the interrupt lands in the post-neutralization window—on Zen 2, two instructions spanning six bytes—the flow is redirected to an interrupt handler that poisons microarchitectural states. The result is speculative execution of disclosure gadgets with access to kernel memory.

According to data published by Trujillo and Yan, interrupts land in the vulnerable window in 5%–12% of cases; with attacker-controlled registers, the rate drops to approximately 2%. On a Zen 2 system running Linux 6.14.0-37 with Spectre-v2 mitigations active, the misprediction rate is 0.75%. The demo broke KASLR in 10 out of 10 runs and located /etc/shadow in 5 out of 10, averaging roughly 18 minutes per attempt.

"An attacker without any special access to read arbitrary memory from the system, including sensitive data such as hashed passwords" — Daniël Trujillo, MIT CSAIL

The Missed Sync: Patch Available, Verification Hard

The kernel commit "x86/bugs: Make Safe-RET robust against interrupt injection," signed by AMD engineers Borislav Petkov and David Kaplan on June 2, 2026, modifies register state handling to simulate Safe-RET completion without executing RET after interrupt return. This eliminates the vulnerable window.

AMD-SB-7061, published August 6, 2026, confirms the Safe RET issue and demonstrations on Zen 1 and Zen 2, plus potential impact on Zen 3 and Zen 4. However, administrators must check by commit subject to verify the presence of the fix: the source does not specify a kernel version containing the commit, nor whether a CVE has been or will be assigned.

Vendor disclosure occurred on February 5, 2026. Six months elapsed between that date and the advisory publication; the kernel patch was merged four months before the advisory. The gap is procedural: the fix existed, but those who needed to verify its presence lacked standard identifiers.

Vendor Responses: Three Risk Assessments

Intel, through Jerry Bryant, Senior Director of Intel Product Assurance and Security, states the behavior falls within BHI/IMBTI scenarios already covered by existing guidance. Intel awarded a discretionary bug bounty but does not believe additional mitigations are necessary. Public data shows misprediction on Arrow Lake (0.22%) and Cascade Lake Refresh (0.037%), but no end-to-end leakage has been demonstrated on Intel architecture.

Arm classifies the behavior as "passive leakage," placing it within its Spectre-v2/BHB guidance. The dossier does not specify whether Arm architectures are practically exploitable.

AMD published a dedicated advisory; Intel and Arm absorbed the issue into their existing frameworks. This editorial reading is based on official statements reported by the sources.

The Risk Profile: Who Is Exposed

The attack requires local unprivileged code execution and access to precision timers. In multi-tenant containerized environments, these conditions could be met: the source mentions "multi-tenant container impact" as a risk, but does not confirm that any container can trigger the exploit.

For cloud and virtualized infrastructures, where kernel isolation is fundamental, TONTOU stands as concrete evidence that Spectre-v2 mitigations remain incomplete on unpatched AMD systems.

Demonstrations were conducted on Linux; the dossier does not specify whether Windows is affected. No evidence of in-the-wild exploitation has emerged.

What to Do Now

Administrators must check by commit subject: search your kernel for the commit "x86/bugs: Make Safe-RET robust against interrupt injection" by Borislav Petkov and David Kaplan, dated June 2, 2026. The source does not specify a kernel version containing the fix.

Verify whether your systems run AMD Zen 1, Zen 2, Zen 3, or Zen 4 processors. AMD-SB-7061 lists all these families as affected; end-to-end demonstrations cover Zen 2.

Monitor the release of the full paper at the USENIX Security 2026 conference (October 27–29) for additional operational details.

With primary sources limited to a vendor advisory and specialized technical coverage, some operational details remain to be confirmed upon release of the USENIX paper.