New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs  Swati Khandelwal  Aug 06, 2026 Vulnerability / Hardware Security An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan named the technique INTERRUPT INJECTION . On an AMD Zen 2 machine running Linux 6.14 with every default Spectre v2 mitigation on, their exploit leaked arbitrary kernel memory at 5.47 bytes per second with 91.97% accuracy, enough to locate and read /etc/shadow, which stores the system's password hashes, in five of ten attempts. It needs no privileges, only local code execution, so the risk sits on shared systems running an affected processor. The pair disclosed to AMD and Intel on February 5. AMD told them it plans a kernel patch; MIT says one has since shipped and arrives in a normal operating system update. AMD published a bulletin on August 6, AMD-SB-7061 , titled "Safe RET Interrupt Vulnerability," naming Zen 1 through Zen 4 processors as affected. Its summary says an attacker running code on an affected system "could inject an interrupt at a precise moment to disrupt Safe RET," which "could potentially weaken that protection and may result in information disclosure." AMD adds that the issue "appears to be associated with the Linux implementation of the Safe RET mitigation." The bulletin credits Trujillo and says the behavior was demonstrated on Zen 1 and Zen 2, with Zen 3 and Zen 4 suggested but not demonstrated. The paper reports AMD testing on Zen 2 and Zen 4 only. The section headed "Affected Products and Mitigation" lists processors and nothing else: no patch version, no kernel commit, and no CVE. According to the paper the researchers shared with The Hacker News, Intel does not consider a mitigation necessary. The bulletin does not close the gap for defenders. With no version number, commit, or CVE to check against, an administrator still has no straightforward way to tell whether a given machine already carries the patch MIT says has shipped, or whether the fix is still in flight. The kernel reports SRSO status at /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow, and the documentation defining that file's values made no mention of interrupts when The Hacker News checked it on August 6. The Hacker News has contacted AMD, Intel, and Arm for comment and will update this story with any response. Each of these defenses sanitizes or isolates branch predictor state so an attacker's earlier training cannot steer a kernel branch. Intel does it on kernel entry, with eIBRS and, depending on the processor, either a branch history buffer clearing loop or the BHI_DIS_S control. AMD does it immediately before each kernel return, with saferet. All of them assume nothing hostile runs in between. Trujillo and Yan call the class TONTOU, for Time-of-Neutralization to Time-of-Use, after the TOCTOU races familiar from software. Interrupts break that assumption, because they fire almost anywhere and Linux lets any user schedule them with nanosecond granularity. If interrupt handling can execute between neutralization and use, the interrupt-return path is part of the Spectre v2 defense even when the mitigation was designed around kernel entry or return. On Zen 2 that window is two instructions, six bytes. The researchers widened their odds by evicting those bytes from L1 and L2 cache using a sibling hyperthread, slowing them down, and by picking the write syscall, which left them controlling two registers. Interrupts landed inside the window 5% to 12% of the time, and around 2% with those registers under attacker control. Once inside, the handler itself became the training gadget, armed with Inception ( CVE-2023-20569 ) to fill the return stack buffer with an attacker-chosen target. Inception is the 2023 AMD flaw saferet exists to stop. Mispredictions turned up in kernel code on three of the four machines tested, at success rates of 0.75% on Zen 2, 0.22% on Intel Arrow Lake, and 0.037% on Cascade Lake Refresh. Zen 4 produced none in that test, and no end-to-end leak was demonstrated on Intel, where the attacker would also need a usable disclosure gadget already in the kernel. The researchers do not treat that as a barrier. Mispredictions are "a necessary but not sufficient condition for a Spectre attack," they told The Hacker News, and because prior work has already shown disclosure gadgets exist in kernels, "we believe an end-to-end attack is possible on Intel as well by combining our Interrupt Injection primitive with this work." Intel paid a discretionary bug bounty bonus but, per the paper, "does not consider mitigation to be required," saying exploitability "depends on many factors" and that the technique is covered by existing guidance . The Hacker News reviewed that guidance, INTEL-SA-00598, in its current version last updated in May 2025, and found no mention of interrupts anywhere in it. Their proposed fix is a second neutralization on the way out of an interrupt: stuff the return stack buffer before iret, or issue IBHF there on newer Intel parts. Blocking interrupts for the length of the window would carry a performance cost the paper does not quantify. The pair presented the work at Black Hat USA today, and the paper is due at USENIX Security in Baltimore next week. As of August 6, the artifact repository named in it was not yet public. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post. SHARE      Tweet  Share  Share  Share   Share on Facebook  Share on Twitter  Share on Linkedin  Share on Reddit  Share on Hacker News  Share on Email  Share on WhatsApp Share on Facebook Messenger  Share on Telegram SHARE  AMD , CPU Security , hardware security , information disclosure , Kernel Security , linux , security research , Side-Channel Attack , Spectre , Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders