TONTOU: The Attack That Nullifies Spectre v2 Mitigations and…

MIT CSAIL researchers demonstrated a bypass of Spectre v2 mitigations on Linux at Black Hat USA 2026. TONTOU extracts password hashes from /etc/shadow in 18 minutes with a 50% success rate.

Daniël Trujillo and Mengjia Yan of MIT CSAIL presented the TONTOU attack at Black Hat USA 2026, a bypass of neutralization-based Spectre v2 mitigations that allows unprivileged programs to extract sensitive data from Linux kernel memory. The technique exploits a previously overlooked temporal window between branch predictor sanitization and its actual use, proving that defenses considered standard for years contain a previously unanalyzed attack surface.

Key Takeaways

TONTOU bypasses eIBRS on Intel and Safe RET on AMD, the neutralization-based Spectre v2 mitigations enabled by default in Linux kernels
On AMD Zen 2 with Linux 6.14.0-37-generic, the attack leaks kernel memory at 5.47 bytes/s with 91.97% accuracy
In 5 of 10 attempts, researchers successfully extracted the contents of /etc/shadow with an average time of 18 minutes
Interrupt injection combined with Inception enables re-poisoning of the branch predictor in the post-neutralization window

How the TONTOU Window Works

Neutralization-based mitigations operate on an apparently sound principle: isolate or restore the branch predictor state before potentially malicious code can influence privileged execution flows. On Intel this mechanism is eIBRS; on AMD, Safe RET. Both technologies are enabled by default in modern Linux kernels and constitute the baseline protection against Spectre v2.

TONTOU — an acronym for Time-of-Neutralization to Time-of-Use — identifies a temporal gap between these two phases. According to the researchers, during kernel execution it is possible to schedule precisely aligned timer interrupts that redirect execution to an interrupt handler. This handler operates inside the post-neutralization window, before the victim branch is actually executed, and allows re-injection of poisoned state into the branch predictor.

The complete attack sequence comprises four stages: neutralization, redirection, poisoning, and use of the compromised branch predictor. Neutralization occurs correctly; redirection interrupts it; poisoning restores the Spectre v2 conditions; use executes the leak.

Concrete Exfiltration Metrics

Tests conducted on an AMD Zen 2 system with 16GB RAM and kernel Linux 6.14.0-37-generic produced precisely measured metrics. The arbitrary kernel memory leak rate measured 5.47 bytes/s with 91.97% accuracy. For operational context, the researchers targeted the /etc/shadow file, which contains system password hashes.

Across 10 proof-of-concept executions, the attack successfully located and extracted the file contents in 5 cases. The average time per attempt was 18 minutes. These numbers derive exclusively from BleepingComputer reporting, the sole primary source with access to the Black Hat USA 2026 presentation; no independent verification of the same metrics is available.

"An attacker without any special access to read arbitrary memory from the system, including sensitive data such as hashed passwords" — Daniël Trujillo, MIT CSAIL

The Inception Combination and AMD Response

The researchers combined the interrupt injection primitive with Inception, a previously disclosed attack from Trujillo himself. Inception — known by identifier CVE-2023-20569 — enables controlled poisoning of the Return Stack Buffer (RSB). The overlap of the two techniques expands the attack surface: interrupt injection provides precise timing, Inception provides the microarchitectural payload.

AMD published an advisory stating that the interrupt injection issue "appears to be associated" with the Linux implementation of Safe RET. The cited measure does not clarify whether a coordinated microcode or kernel patch release is planned. No specific CVE for TONTOU appears in the sources examined.

What Differentiates Intel from AMD in Testing

The attack is reproducible on both architectures but with substantial differences. On AMD Zen 2 the full chain works with updated mitigations. On Intel, complexity increases due to additional unspecified software requirements not detailed by the source.

A secondary source adds that on Intel Cascade Lake Refresh and Arrow Lake the team succeeded in retraining some branch prediction mechanisms, while on AMD Zen 4 the false branching technique was not observed with the same method. These additional data points come from Gigazine, which attributes them to the research paper; it is not verifiable whether they derive directly from the academic work or the conference presentation.

Why This Matters

The stakes exceed a single proof-of-concept. Neutralization-based mitigations are considered a non-negotiable baseline in most enterprise and cloud Linux systems. Their invalidation reconstructs a risk condition the industry considered resolved for years, with direct impact on threat models for multi-tenant hosting and cloud providers.

The dossier does not specify whether a kernel patch is in development or on what timeframe it might be released. It is unclear whether existing kernel configurations can partially mitigate the attack, nor whether the academic paper is already accessible outside the Black Hat USA 2026 presentation. The source indicates official publication is slated for USENIX Security 2026, with conference dates set for October 27-29.

The brief documents no specific corrective measures and provides no operational guidance for system administrators awaiting updates.

FAQ

Is TONTOU a new Spectre v2 variant?
No. It is a bypass of existing mitigations, not a variant of the original vulnerability. Spectre v2 remains the reference class; TONTOU demonstrates that active defenses can be evaded via timing attack.

Does the 50% success rate make the attack irrelevant in practice?
The 50% across 10 lab attempts does not establish operational relevance. It establishes feasibility. In microarchitectural security, the demonstration that a standard mitigation is bypassable typically precedes optimization of the attack chain.

Which systems are at immediate risk?
The dossier specifies AMD Zen 2 with Linux 6.14.0-37-generic. On Zen 4 the same pattern was not observed; on Intel complexity is higher. The source does not provide a complete risk matrix for processor families or kernel versions.

Information is based on the cited source and current as of publication.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references