Two MIT CSAIL researchers have described a new class of speculative execution attack that bypasses current Spectre v2 defenses on recent AMD and Intel processors, using precisely timed interrupts to re-poison branch predictor state. The research is detailed in a paper by Daniël Trujillo and Mengjia Yan, shared ahead of publication and first reported by The Register on August 7.
The attack targets the mitigations that Intel and AMD use to neutralize branch predictor state before privileged code runs. These defenses, which include Intel’s eIBRS and AMD’s Safe RET, assume that once predictor state is cleared or isolated, an attacker cannot interfere with it before the processor uses it again. Trujillo and Yan call the period between neutralization and use the post-neutralization window, and they argue that assumption does not hold.
Their new attack class is named TONTOU, for Time-of-Neutralization to Time-of-Use. The key primitive is interrupt injection: an unprivileged program schedules high-frequency timer interrupts in the hope that one lands inside the often tiny post-neutralization window. When it does, control flow is diverted through an interrupt handler that re-poisons predictor structures such as the return stack buffer (RSB) or branch history buffer (BHB). A protected branch then speculatively jumps to a disclosure gadget that leaks kernel data over a microarchitectural side channel.
How the attack was demonstrated
The researchers tested TONTOU on four systems: AMD Zen 2 (Ryzen 7 4700G) and Zen 4 (EPYC 9124), plus Intel Cascade Lake Refresh (Xeon Gold 5220R) and Arrow Lake (Ultra 9 285H), running stock Linux kernels between 5.15 and 6.14 with all default mitigations enabled. They built a complete end-to-end exploit only for Zen 2, which leaks arbitrary kernel memory at a rate of 5.47 bytes per second with 91.97 percent accuracy.
In a real-world demonstration, the exploit broke the kernel’s address space layout randomization (KASLR) and located the /etc/shadow file containing the hashed root password. Across ten runs averaging 18 minutes each, the researchers found the file in five attempts, after which they could read its contents. The Register reports that Intel awarded a bug bounty prize in the hundreds of dollars, while AMD committed to addressing the issue with a kernel patch.
What the vendors said
The researchers disclosed the work to AMD and Intel on February 5, 2026, and both vendors confirmed the underlying behavior. AMD said it plans to mitigate the attack through a kernel patch. Intel said it does not consider a mitigation required, arguing that practical exploitability depends on many factors, and pointed to existing guidance that does not mention interrupts as a vector. Arm, which also uses neutralization-based mitigations, was informed in April and told the researchers the interrupt injection falls under “passive leakage” that it does not actively protect against.
The practical bar remains high. Speculative side-channel attacks are difficult to chain, and the end-to-end exploit targets a narrow window in kernel execution. But the researchers stress that their demonstration assumes nothing special: a stock Linux kernel, no inserted modules, and default mitigations. That makes multi-tenant container platforms the most exposed scenario, where unprivileged user-space programs share the kernel with a victim. The finding also lands as the industry races to wring more performance out of the same microarchitecture, part of the broader chip race Neon Control has covered before.
Trujillo and Yan, who also worked on the 2023 Inception attack, hope the research pushes chipmakers and operating system vendors toward stronger defenses for the post-neutralization window. The Register reports the work is set to be presented at DEF CON 34.
