Full research report

New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

INTERRUPT INJECTION exposes a race-like assumption inside speculative-execution mitigations: prediction state can be neutralised and then contaminated again before its protected use. The strongest practical evidence is an unprivileged AMD Zen 2 Linux demonstration that crossed the kernel boundary and recovered protected memory; Intel results reached predictor misprediction but not end-to-end disclosure. CVE-2023-20569 is relevant because its Inception behaviour supplied the AMD return-prediction primitive, but it is not an identifier for the newly disclosed timing weakness. The Linux Safe-RET change provides an evidenced correction for affected AMD systems, while broader processor coverage and Intel exploitability remain incompletely resolved.

What happened

MIT CSAIL researchers Daniël Trujillo and Mengjia Yan disclosed INTERRUPT INJECTION on 6 August 2026 after notifying AMD and Intel in February and Linux maintainers in March. The technique times an interrupt to occur between branch-predictor neutralisation and subsequent use, allowing the interrupt path to reintroduce attacker-influenced prediction state. An end-to-end kernel-memory disclosure was demonstrated on AMD Zen 2 under Linux 6.14, while Intel testing produced mispredictions but not a complete data leak.

Affected scope

The demonstrated exploit requires unprivileged local code execution on a Linux host and was completed on AMD Zen 2 with default Spectre v2 mitigations enabled. The research also tested AMD Zen 4 and Intel Arrow Lake and Cascade Lake Refresh; mispredictions were observed on both tested Intel systems, but Zen 4 did not mispredict in the cited test and no Intel end-to-end disclosure was demonstrated. Reporting says AMD-SB-7061 lists Zen 1 through Zen 4, although demonstrations and test coverage differ across those generations.

Technical assessment

Spectre v2 mitigations sanitise or isolate branch-prediction state before a protected transition, but execution cannot neutralise and consume that state simultaneously. A precisely timed interrupt can run in this interval and alter predictor state after the mitigation has acted. On AMD, the researchers combined this timing condition with the previously documented Inception return-prediction weakness, CVE-2023-20569, and demonstrated speculative kernel-memory disclosure; predictor misprediction alone does not establish a usable disclosure path on Intel.

Recommended defensive actions

  1. update affected Linux systems to an operating-system or kernel release containing commit 7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9 or the distributor's backport
  2. inventory shared and multi-tenant Linux hosts using AMD Zen 1 through Zen 4 processors and prioritise systems that execute untrusted local workloads
  3. verify kernel package changelogs or source ancestry for the Safe-RET interrupt-injection fix rather than relying solely on the existing SRSO status file
  4. restrict untrusted local code execution and cross-tenant sharing on unpatched affected AMD systems until the kernel correction is deployed
  5. monitor AMD, Intel and Linux distributor advisories for processor-specific scope changes and backport identifiers

Uncertainties and evidence gaps

  • No new CVE was identified for INTERRUPT INJECTION itself; CVE-2023-20569 covers the earlier Inception primitive rather than the newly disclosed timing weakness.
  • No end-to-end information disclosure was demonstrated on Intel, so practical exploitability there remains unconfirmed and depends on additional usable kernel disclosure behaviour.
  • The reviewed reporting and MIT account say attack code is public, but a repository specifically containing the new INTERRUPT INJECTION implementation was not located during verification.
  • AMD generation coverage is inconsistent: reporting says the bulletin lists Zen 1 through Zen 4, while demonstrated or experimental results cover only subsets of those processors.
  • No evidence of malicious exploitation outside the controlled research environment was found.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnprivileged local code execution on a system where the attacker can schedule precisely timed interrupts; remote-only exposure was not demonstrated.
ComponentLinux interrupt-return handling and the processor branch-prediction state protected by Spectre v2 and AMD Safe-RET mitigations.
MechanismAn interrupt occurs after prediction state has been neutralised but before protected use, allowing the interrupt path to reintroduce attacker-influenced state.
ImpactPotential speculative disclosure of privileged kernel memory; an end-to-end leak was demonstrated on AMD Zen 2.
DetectionNo reliable attack-specific indicator was identified in the reviewed sources; defenders can verify whether the running kernel contains the Safe-RET interrupt-injection correction and investigate unusual high-resolution timer activity on exposed shared workloads.
MitigationInstall a kernel or operating-system update containing Linux commit 7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9 or an equivalent vendor backport for affected AMD systems.
Exploitation status

No active exploitation has been reported; researchers demonstrated a working local exploit on AMD Zen 2, and public technical material plus code for the underlying Inception primitive are available.

Research process

The investigation first separated the newly disclosed interrupt-timing condition from CVE-2023-20569, which is an earlier AMD weakness used by the demonstration. MIT's account and the research paper establish a working AMD Zen 2 disclosure, while the Linux change independently confirms that interrupting Safe-RET can enable speculative leakage. NVD and the original Inception research confirm the role and local-access characteristics of CVE-2023-20569; the available evidence does not establish malicious exploitation or a complete Intel exploit.

  1. What event was reported, and what claims required primary verification?
    Reviewed the supplied report and extracted its disclosure timeline, affected-platform claims, measured AMD result, Intel limitations and cited correction.
    thehackernews.com ↗

    The report described an August 2026 disclosure of INTERRUPT INJECTION, a successful AMD Zen 2 Linux memory leak, predictor mispredictions on tested Intel processors and a Linux Safe-RET correction.

    why This framed the event while preserving the distinction between demonstrated disclosure, predictor misprediction and vendor-listed exposure.

  2. Did the researchers' institution corroborate the attack and disclosure timeline?
    Read MIT CSAIL's publication about the work.
    csail.mit.edu ↗

    MIT confirmed testing across Intel and AMD, a working AMD exploit that recovered protected data, February disclosure to AMD and Intel, March contact with Linux maintainers and availability of an operating-system update.

    why This independently corroborated the central demonstration and mitigation timeline, while not claiming real-world malicious use.

  3. Does the Linux correction explicitly address interrupt injection against Safe-RET?
    Inspected the substantive Linux commit containing the correction.

    The commit states that interrupting Safe-RET on systems affected by Speculative Return Stack Overflow can neutralise the sequence and potentially leak data; it corrects register state and avoids executing RET after the interrupt.

    why The kernel change independently validates the AMD mechanism and supplies a concrete defensive control.

  4. Is a primary technical publication available?
    Opened the researchers' TONTOU paper.
    people.csail.mit.edu ↗

    A public paper exists for the Time-of-Neutralization to Time-of-Use research and INTERRUPT INJECTION technique.

    why The paper establishes that the disclosure is supported by formal technical research rather than only secondary reporting.

  5. Could a public repository specifically for the new technique be verified?
    Searched GitHub repositories for TONTOU and interrupt injection.
    github.com ↗

    The repository search returned no matching repository.

    why This prevented an unsupported claim that a specific public code repository for the new attack had been verified, despite MIT's statement that code is publicly available.

  6. How does CVE-2023-20569 relate to this story?
    Reviewed the National Vulnerability Database record.
    nvd.nist.gov ↗

    CVE-2023-20569 is a local, high-complexity AMD side-channel vulnerability that can influence return-address prediction and potentially disclose information.

    why This confirms that the CVE covers the earlier Inception primitive, not the newly disclosed interrupt-timing condition.

  7. Is the underlying Inception technique and exploit material public?
    Reviewed the original ETH Zurich Inception research page.
    comsec.ethz.ch ↗

    The researchers describe unprivileged information disclosure on modern AMD processors, identify CVE-2023-20569 and link public resources.

    why This corroborates the underlying predictor-manipulation primitive used by the AMD demonstration.

  8. Does the linked Inception resource contain public code?
    Opened the linked Inception repository and inspected its contents.

    The repository contains C, shell and Python artefacts for Inception, Training in Transient Execution and PhantomCALL.

    why This verifies public exploit material for the historical primitive while avoiding the false implication that it implements the new interrupt-injection timing method.

Named in this story
TargetsMulti-tenant and shared Linux systemsLinux hosts using affected AMD Zen processorsSystems permitting untrusted local code execution
Related CVEs CVE-2023-20569

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 2 registered sources supplied useful evidence (2 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 59 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok14 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1661 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5321 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok675 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1007 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok3 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok16 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 14 opened outside the registered collection
References & evidence
PoC & exploit code2
TONTOU: On the Exploitability of Time-of-Neutralization to Time-of-Use people.csail.mit.edu ↗

Research paper describing INTERRUPT INJECTION and the demonstrated AMD exploit.

Inception: how a simple XOR can cause a Microarchitectural Stack Overflow comsec.ethz.ch ↗

Original technical explanation of the earlier Inception weakness and its information-disclosure capability.

Vendor & gov advisories1
NVD: CVE-2023-20569 nvd.nist.gov ↗

Government record for Inception, the pre-existing AMD weakness used as a primitive in the demonstrated attack.

Analysis & research3
A new attack slips past the latest defences built into your computer's processor csail.mit.edu ↗

MIT CSAIL account of the experiments, disclosure timeline, demonstrated leakage and available mitigation.

New Interrupt Injection Attack Can Bypass Spectre v2 defences on Intel and AMD CPUs thehackernews.com ↗

Detailed reporting that identifies tested processors, Linux conditions, measured results and the AMD product bulletin.

TONTOU research paper people.csail.mit.edu ↗

Primary publication defining the broader Time-of-Neutralization to Time-of-Use attack class.