> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# Spectre is Back: CPU Mitigations  Found to Be Ineffective
- URL: https://www.privacyguides.org/news/2026/08/07/spectre-is-back-cpu-mitigations-found-to-be-ineffective/
- Published: 2026-08-07T00:17:01.000Z
- Updated: 2026-08-07T00:17:01.000Z
- Description: Researchers found a way to bypass the latest Spectre mitigations and exploit AMD and Intel processors to leak secrets like passwords and encryption keys.
- Author: Fria Reyes
- Tags: News Briefs

Researchers [found](https://thehackernews.com/2026/08/new-interrupt-injection-attack-can.html) a way to bypass the latest Spectre mitigations and exploit AMD and Intel processors to leak secrets like passwords and encryption keys.

Modern CPUs are fast, but they don't achieve that speed just from raw processing power: they use what's called [branch prediction](https://joegm.github.io/blog/branch-prediction-demystified/) and [speculative execution](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/hardware-behavior-related-to-speculative-execution.html) to try and guess what the outcome of a conditional statement is before it's actually evaluated and execute code earlier.

While it seems like magic that this technique can speed up our processors so much, [researchers](https://spectreattack.com/spectre.pdf) found a way to exploit these features to steal data like passwords, encryption keys, browser data, or really anything in an exploit dubbed "Spectre."

CPU manufacturers released patches to fix these flaws, but seemingly they weren't enough. Intel's [eIBRS](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/branch-history-injection.html#:~:text=eIBRS%20prevents%20Branch%20Target%20Injection%20%28Spectre%20v2%29%20by%20preventing%20less%20privileged%20modes%20from%20specifying%20the%20predicted%20targets%20of%20indirect%20jumps.) promises to prevent "Branch Target Injection (Spectre v2) by preventing less privileged modes from specifying the predicted targets of indirect jumps." AMD's Safe RET promises to similarly protect against this attack.

According to the [paper](https://people.csail.mit.edu/mengjia/data/2026.USENIX.TONTOU.pdf) released by the researchers, modern Spectre mitigations work by "neutralizing" the branch predictor state, sanitizing it and isolating different states, such as when switching between privilege contexts.

These features assume that everything between the neutralization phase and when the state is actually used is safe, however there is a small post-neutralization window that's just big enough to completely break the security protections.

The researchers dubbed this type of attack Time-of-Neutralization to Time-of-Use (TONTOU).

They were able to make use of [interrupts](https://eng.libretexts.org/Courses/Delta%5FCollege/Introduction%5Fto%5FOperating%5FSystems/04%3A%5FComputer%5FArchitecture%5F-%5Fthe%5FCPU/4.02%3A%5FInterrupts) to exploit this window reliably across Intel and AMD chips using what they dub an Interrupt Injection attack. It's widely assumed that interrupts are benign, but as with many assumptions in tech, this proved to be very wrong.

They were able to create an end-to-end attack that could reliably expose kernel memory with an accuracy of 91.97%, including the root password located at `/etc/shadow` .

The attack only needs local code execution; it works with a completely unprivileged user with all modern Spectre V2 mitigations enabled.

The researchers say they disclosed the attack to both AMD and Intel on February 5th, 2026, and both confirmed the behavior. AMD said they will release a patch, which they seemingly [did](https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7061.html), but Intel didn't think the attack warranted a fix.

They also contacted the Linux kernel about it. [Reportedly](https://thehackernews.com/2026/08/new-interrupt-injection-attack-can.html), a [patch](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f5fdd6665ac4d8528ed1c9242cb1cf7a7f5bdb0e) has landed in the kernel now.