MIT CSAIL researchers Daniel Trujillo and Mengjia Yan have demonstrated a microarchitectural attack that bypasses Spectre v2 mitigations on AMD Zen 2 processors and leaks Linux password hashes from userspace without privileges. Dubbed TONTOU or interrupt injection, the technique re-poisons the branch predictor after the processor has sanitized it, defeating the retpoline and Safe-RET defenses most Linux systems rely on.
How Interrupt Injection Reopens the Spectre v2 Window
An unprivileged Linux program times a hardware interrupt to land in the gap between the processor sanitizing its branch predictor and the kernel using it. By re-poisoning the predictor after the Spectre v2 mitigation has run, the attacker reopens the transient-execution window the defenses are designed to close. The researchers demonstrated the attack on an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation enabled.
Reading /etc/shadow From Userspace at 5.47 Bytes Per Second
The attack leaks data at 5.47 bytes per second with 91.97 percent accuracy, a rate sufficient to extract the /etc/shadow password hash. In the demonstration, it succeeded in reading the hash in 5 of 10 attempts. No privileges are required beyond running an unprivileged local process, which makes the attack viable for any multi-user system where an attacker can run code.
The June 2026 Linux Mitigation and the Disclosure Timeline
The researchers disclosed the technique to vendors on February 5, and a Linux mitigation described as making Safe-RET resilient to interrupt injection was committed by Petkov and Kaplan on June 2. The fix is now part of the upstream kernel and will reach users through distro kernel updates.
Why the Attack Breaks a Foundational Assumption
The demonstration undermines the assumption that branch-predictor sanitization, as implemented in retpoline and Safe-RET, fully closes the Spectre v2 window. Rather than exploiting a previously unknown speculative mechanism, TONTOU works by manipulating the timing of a hardware interrupt so that sanitization and use are separated in a way the mitigation does not account for.
What the TONTOU Attack Means for Local Threat Models
For the affected class of systems — AMD Zen 2 machines running Linux, and other CPUs that depend on retpoline or Safe-RET — the attack changes the local threat model. An unprivileged user on a shared system can, in principle, read kernel secrets that include password hashes.
Applying the Safe-RET Hardening and Reconsidering Multi-User Access
Organizations should apply the June 2 Linux kernel mitigation, ensuring distro kernels that include the Safe-RET interrupt-injection hardening are deployed. For high-security environments, the practical consequence is to treat local multi-user access as a meaningful attack surface rather than a trusted boundary, since the exploit needs no privilege and no special hardware.
The attack’s significance is less about a single CPU model than about what it says about the limits of microarchitectural mitigations. Because the fix hardened Safe-RET rather than removing the vulnerable behavior, TONTOU shows that side-channel patches are often reactive tightening of an assumption — sanitization closes the window — that an attacker can reopen by manipulating hardware events outside the mitigation’s view. For defenders, the lesson is that microarchitectural defenses age faster than the hardware they protect, and local-access isolation is the durable control.
The wider implication is that the Spectre problem has not been closed by the cumulative set of mitigations that protected systems after the original disclosures. Each bypass — from the initial speculative execution variants through retpoline and Safe-RET — has hardened a specific path while leaving the underlying assumption that the operator controls when speculation can be poisoned. TONTOU narrows that assumption to a timing window an unprivileged process can exploit with nothing more than a loop and an interrupt. That keeps the issue in a category that carries a structural reminder for operators: keep multi-user environments patched with the newest kernel, but do not build the security of a shared system on the premise that no local user would ever attempt to read secrets. Physical co-tenancy on a host, or shell access on a shared server, is now part of the threat surface this research makes explicit.
