TONTOU Bypasses Spectre v2 Mitigations, Leaks Linux Password Hashes in 18 Minutes

August 6, 2026, 2:03 PM EDT, Las Vegas. Daniël Trujillo, a PhD student at MIT CSAIL, takes the stage at Black Hat USA. He is not demonstrating a new malware strain. He is showing how four years of Spectre v2 mitigations on Intel and AMD processors can be bypassed with 91.97% accuracy. In an average of 18 minutes, his attack extracts /etc/shadow from a Linux 6.14 machine — the file that stores password hashes.

TONTOU — Time-of-Neutralization to Time-of-Use — is not a new Spectre variant. It is a methodical exploitation of an assumption that current defenses took for granted: that the window between cleaning the branch predictor and using it is unexploitable.

Spectre v2’s Poisoned Legacy

Spectre v2, also known as Branch Target Injection (BTI), exploits a processor’s indirect branch predictor. The CPU speculates on the target of an indirect branch; an attacker can poison that prediction, causing speculative execution at an attacker-chosen code location and then observing cache side effects to infer sensitive data.

Both CPU families deployed so-called neutralization-based mitigations:

• Intel: eIBRS (enhanced Indirect Branch Restricted Speculation) — isolates the branch predictor across security domains.
• AMD: Safe RET — cleans the Return Stack Buffer (RSB) during kernel↔userspace transitions.

Both mechanisms share a common assumption: clean the predictor before a victim uses it, under the belief that an attacker cannot re-poison it between cleaning and use.

TONTOU demolishes that assumption.

The TONTOU Window: What Mitigations Miss

The core insight from Trujillo and his advisor, Professor Mengjia Yan, boils down to one sentence: there exists a gap between the moment the CPU neutralizes the predictor and the moment victim code uses it.

During that gap — the TONTOU window — an unprivileged attacker can re-poison the microarchitectural state before the victim gets to use it.

The researchers identified four stages:

1. Neutralization: the kernel returns from a syscall; Safe RET or eIBRS cleans the predictor.
2. Redirection: the attacker triggers a hardware interrupt (timer interrupt) inside the post-neutralization window.
3. Poisoning: the interrupt handler — legitimate kernel code — is hijacked to re-poison the branch predictor.
4. Use: victim code executes an indirect branch with the poisoned predictor, speculating toward an attacker-chosen gadget.

“An attacker without any special access can read arbitrary memory from the system, including hashed passwords,” Trujillo told BleepingComputer.

Practical Execution: /etc/shadow in 18 Minutes

On an AMD Zen 2 system running Linux 6.14.0-37-generic with 16 GB of RAM, the researchers demonstrated the full attack chain:

• Exfiltration rate: 5.47 bytes/second
• Accuracy: 91.97%
• Target: the /etc/shadow file (password hashes)
• Success rate: 5 out of 10 attempts, each taking an average of 18 minutes

The throughput sounds low, but it is sufficient for extracting static secrets. A password hash typically spans 80 to 120 characters — a target perfectly suited to TONTOU’s pace.

On Intel, the attack is technically feasible but more complex — additional software constraints on interrupt timing make exploitation less reliable without platform-specific tuning.

The Interrupt Injection Vector

TONTOU’s key technical innovation is interrupt injection by an unprivileged process. The researchers exploit the fact that Linux user programs can schedule timer interrupts that execute in kernel context:

# An unprivileged process can create a high-resolution timer
# that triggers a kernel interrupt at a precise moment
timerfd_create(CLOCK_MONOTONIC, 0);
timerfd_settime(fd, TFD_TIMER_ABSTIME, &spec, NULL);

The interrupt forces the kernel to jump to the interrupt handler, which the researchers use as a poisoning vector for the branch predictor. The challenge is temporal alignment: the interrupt must land precisely within the post-neutralization window, which lasts only a few CPU cycles.

To overcome this, TONTOU employs:

• Frequent injection: multiplying attempts to maximize alignment probability.
• High-resolution timers: nanosecond granularity through timerfd.
• Active poisoning: direct manipulation of the predictor via the interrupt handler.
• Passive poisoning: pollution of the RSB (Return Stack Buffer) through nested calls/returns.

The researchers note that since passive poisoning is less reliable, they combined it with Inception — an earlier attack co-developed by Trujillo — to stabilize exploitation on AMD Zen 2.

AMD’s Response and Broader Implications

AMD published an advisory on August 6, 2026, acknowledging that the interrupt injection issue “appears to be associated” with the Linux implementation of the Safe RET mitigation. The advisory does not yet detail a hardware fix — the correction will likely come through the Linux kernel.

The implications extend beyond AMD:

• Any neutralization-based mitigation is structurally vulnerable to a TONTOU-style attack. The gap between cleaning and use is inherent to the kernel’s asynchronous programming model.
• Interrupts are a universal vector: any CPU that allows a user to trigger hardware interrupts (even indirectly, through timers) is exposed.
• Kernel fixes take priority: Linux maintainers will need to rethink interrupt scheduling around the predictor neutralization points.

Verdict

TONTOU is not a bug — it is the predictable consequence of a defense built on a sequencing assumption that ignored the intrinsic parallelism of modern hardware.

If you manage Linux servers exposed to unprivileged code (shared machines, containers without hardware isolation, multi-tenant VPS), apply kernel patches as soon as they ship. Monitor your distribution’s advisories for Safe RET and eIBRS updates. A 5.47 B/s exfiltration rate makes the attack impractical for bulk data theft, but /etc/shadow in 18 minutes is more than enough to compromise a privileged account.

If you run a heterogeneous Intel/AMD fleet, note that the attack is validated on Zen 2 and theoretically applicable to Intel — the added difficulty on Intel is not a reliable protection.

References

• BleepingComputer, New TONTOU CPU attack bypasses Spectre v2 fixes, leaks Linux password hashes, August 6, 2026 — https://www.bleepingcomputer.com/news/security/new-tontou-cpu-attack-bypasses-spectre-v2-fixes-leaks-linux-password-hashes/
• Black Hat USA 2026, TONTOU: Exploiting the Time-of-Neutralization to Time-of-Use Window in Spectre v2 Defenses, Daniël Trujillo & Mengjia Yan, MIT CSAIL — August 6, 2026 presentation
• AMD Security Advisory, August 6, 2026