How MIT Researchers Bypassed the Latest Spectre Mitigations on AMD and Intel CPUs

In a tiny window of time lasting just tens of nanoseconds—the span of two processor instructions—a team of MIT researchers found a way to break the defenses of modern computer chips. Daniël Trujillo and Mengjia Yan at the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) have unveiled a new attack technique that bypasses the latest security mitigations on AMD and Intel processors.[1][2]

Since 2018, the tech industry has been playing a relentless game of whack-a-mole with Spectre, a class of vulnerabilities that exploits "speculative execution." This is the process by which modern CPUs guess what software will do next and execute instructions ahead of time to boost performance. If the guess is wrong, the processor discards the work, but traces of that activity remain in the cache, allowing attackers to siphon protected data.[1][2][5]

To stop the variant known as Spectre v2, chipmakers introduced defenses—such as AMD's Safe RET and Intel's eIBRS—that wipe or isolate the processor's "branch predictor" right before sensitive kernel code runs. The assumption was straightforward: if you clean the predictor's memory, the attacker's poisoned guesses are neutralized before they can do any harm.[2][3][4]

But hardware execution is messy, and the MIT researchers spotted a hidden flaw in that assumption. The moment the predictor is cleaned and the moment it is actually used by the processor are not the exact same instant. There is a microscopic gap between the two events, creating what the researchers call a "post-neutralization window."[1][5]

To pry this window open, the researchers developed a technique called "Interrupt Injection," part of a broader attack class they named TONTOU (Time-of-Neutralization to Time-of-Use). By scheduling high-frequency timer interrupts with nanosecond precision, an unprivileged user program can force the kernel to pause and run an interrupt handler right inside that tiny gap.[2][3][4][6]

Once inside the gap, the attacker can re-poison the branch predictor. The defense worked exactly as designed, but its clean state simply did not last long enough to protect the sensitive code. The processor is tricked into speculatively executing an attacker-chosen path, reopening the very door the mitigations were supposed to bolt shut.[1][4]

How dangerous is this capability in the real world? The researchers built a complete end-to-end exploit on an AMD Zen 2 system running a stock Linux kernel with all Spectre mitigations enabled. They successfully broke the kernel's address space layout randomization and leaked protected memory, including the `/etc/shadow` file that contains root password hashes.[2][3][6]

However, the attack is far from a speed demon. The exploit leaked data at a rate of roughly 5.47 bytes per second. A single attempt to locate and extract the password file took approximately 18 minutes, succeeding in five out of ten test runs. This is a highly precise, slow-moving strike, not a rapid smash-and-grab.[2][3][4][5]

AMD has acknowledged the vulnerability, which is tracked as CVE-2026-68480, confirming that it affects the Linux implementation of its Safe RET mitigation on Zen 1 through Zen 4 processors. A patch addressing the interrupt injection window has already been merged into the Linux kernel and is rolling out in standard operating system updates.[3][4][6]

Intel's response highlights the divide between lab research and practical threats. While the researchers successfully triggered the necessary mispredictions on Intel Cascade Lake Refresh and Arrow Lake processors, Intel stated that real-world exploitation requires highly specific software conditions. The company paid a bug bounty but currently plans no additional mitigations.[1][5]

The discovery of TONTOU proves that neutralizing hardware vulnerabilities with software patches is a game of diminishing returns. Even the most carefully designed defenses leave microscopic windows that dedicated researchers—or sophisticated threat actors—can eventually exploit.[1][4]

For the average desktop user, this is not an immediate reason to panic, as the attack requires local code execution and operates at a crawl. But for cloud providers managing shared server environments, it is a stark reminder that the ghost of Spectre is still deeply embedded in the architecture of modern computing.[1][5]